Documentation

---

The ipapi.is API returns ownership, network, location and security data for any IPv4 or IPv6 address, and registry data for any autonomous system (ASN). A response answers three questions:

• Who owns the address? — company, asn and the abuse contact in abuse.
• Where is it? — location.
• What kind of address is it? — is_datacenter, is_vpn, is_proxy, is_tor, is_abuser, is_mobile, is_satellite, is_anycast, is_crawler and egress_service.

# Quickstart

---

Send the address as q and your API key as key:

curl "https://api.ipapi.is/?q=32.43.11.44&key=your_api_key"

Leave out q to look up the address the request comes from. Leave out key to use the API anonymously, with a shorter response and a low daily limit (see below). Always use api.ipapi.is: it routes every request to the nearest healthy server.

Node.js 18+ (built-in fetch):

fetch('https://api.ipapi.is/?q=32.43.11.44&key=your_api_key')
  .then((res) => res.json())
  .then((data) => console.log(data.is_datacenter, data.is_vpn));

Python (requests):

import requests

res = requests.get('https://api.ipapi.is',
                   params={'q': '32.43.11.44', 'key': 'your_api_key'}, timeout=5)
res.raise_for_status()
data = res.json()
print(data['is_datacenter'], data['is_vpn'])

# Authentication and Limits

---

Requests with a key get the complete response documented on this page, plus bulk lookups and ASN queries. A free account includes 1,000 requests per day, commercial use included. One-time credits that never expire, or a subscription, raise that limit (see pricing). Your key is on the dashboard.

• Send the key as the key query parameter, or in the JSON body of a POST request, which keeps it out of URLs and logs.
• Keep the key on your server. A key in browser JavaScript or a public repository will be found and spent by someone else. You can regenerate it in the dashboard.
• Every lookup counts as one request, also inside a bulk request. Requests answered with an error are not counted.

# Without a key

Keyless requests are limited to 30 lookups per IP address per UTC day and return a minimal response: ownership and location only, without the detection flags. Bulk lookups and ASN queries are refused with 403 ERR_FORBIDDEN_API_KEY_REQUIRED.

{
  "ip": "82.66.115.249",
  "is_bogon": false,
  "company": "Proxad / Free SAS",
  "asn": "AS12322 Free SAS",
  "city": "Goven",
  "region": "Brittany",
  "country": "France",
  "lat": 48.0063,
  "lon": -1.84667,
  "timezone": "Europe/Paris",
  "docs": "https://ipapi.is/free-tier.html?ref=api"
}

Every field is always present and null when unknown. The docs field marks the response as anonymous and links to a page explaining it.

After the 30th lookup, the next 10 requests are answered with 429 ERR_FREE_TIER_EXHAUSTED and a Retry-After header holding the seconds until UTC midnight. A client that keeps sending after that is blocked at the firewall for 24 hours. The budget is counted per IPv4 address and per IPv6 /64, so everyone behind a shared NAT shares it.

# Errors

---

Errors are JSON, whatever output format you asked for, with a message in error and a stable error_code:

{
  "error": "Invalid IP Address or AS Number",
  "error_code": "ERR_INVALID_IP_OR_ASN",
  "elapsed_ms": 0.16
}

Branch on error_code or the HTTP status. The message text may change.

Two responses don't follow this pattern:

• An AS number we have no data for returns 200 with an error message and no error_code: the request was valid, there is just nothing to report.
• A client banned at the firewall gets a bare 403 with an empty body. Clients are banned for ignoring the keyless limit, and for sending many requests that keep being refused, so back off on 429 and 403 instead of retrying.

# Endpoints

---

There is one endpoint, https://api.ipapi.is, for GET and POST. Every response carries Access-Control-Allow-Origin: *, so browsers can call it directly.

# GET Requests

The switches are on only for the exact value 1; in a JSON body, the string "1". true, yes and the number 1 are ignored.

curl "https://api.ipapi.is/?q=3.5.140.2&key=your_api_key"
curl "https://api.ipapi.is/?q=AS42831&key=your_api_key"
curl "https://api.ipapi.is/?q=86.53.104.0&geoloc_meta=1&key=your_api_key"

# Every matching network with all_companies=1

An address is usually covered by several nested WHOIS records: a large allocation to a provider, a sub-allocation to a reseller, an assignment to the end customer. By default company holds the most specific one. With all_companies=1:

• company becomes an array of every matching record, each with its own rir and abuse. The first entry is the one you get by default.
• The top-level abuse object is dropped and the top-level rir is null.

Code that reads response.company.name has to read response.company[0].name instead, so check your parser before turning this on.

# POST and Bulk Requests

POST a JSON body (Content-Type: application/json) with the same parameters as GET. Use q for one lookup, or ips for up to 100 lookups in one request. Bulk lookups need a key.

curl https://api.ipapi.is \
  -H "Content-Type: application/json" \
  -d '{"ips": ["32.5.140.2", "45.33.32.156", "2606:4700::1111", "AS15169"], "key": "your_api_key"}'

The response is an object keyed by the entries you sent. Each value is the same object a single lookup returns, with its own elapsed_ms, and total_elapsed_ms times the whole request:

{
  "32.5.140.2": { "ip": "32.5.140.2", "rir": "ARIN", "...": "...", "elapsed_ms": 0.08 },
  "45.33.32.156": { "ip": "45.33.32.156", "...": "..." },
  "2606:4700::1111": { "ip": "2606:4700::1111", "...": "..." },
  "AS15169": { "asn": 15169, "org": "Google LLC", "...": "..." },
  "total_elapsed_ms": 0.42
}

• ips may mix IPv4, IPv6 and AS numbers. Duplicates and invalid entries are dropped silently, and the limit of 100 applies to what remains.
• Results keep the order you sent them in. total_elapsed_ms sits next to them, so iterate over the entries you sent, not over every key.
• Every entry counts as one request against your quota.
• geoloc_meta and all_companies only apply to q; bulk entries always use the defaults.
• A single q lookup sent by POST has no top-level elapsed_ms.

The same request with fetch():

fetch('https://api.ipapi.is', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    ips: ['32.5.140.2', '45.33.32.156', '2606:4700::1111', 'AS15169'],
    key: 'your_api_key',
  }),
})
  .then((res) => res.json())
  .then((data) => console.log(data));

# Output Formats

Add format= or use the matching path. Every format carries the same data and costs the same.

# Example Response

---

A keyed lookup of 107.174.138.172 returns:

{
  "ip": "107.174.138.172",
  "rir": "ARIN",
  "is_bogon": false,
  "is_mobile": false,
  "is_satellite": false,
  "is_anycast": false,
  "is_crawler": false,
  "is_datacenter": true,
  "is_tor": true,
  "is_proxy": false,
  "is_vpn": false,
  "is_abuser": true,
  "datacenter": {
    "datacenter": "HostPapa",
    "domain": "hostpapa.com",
    "network": "107.172.0.0 - 107.175.255.255"
  },
  "company": {
    "name": "VPS ACE",
    "abuser_score": "0.1016 (High)",
    "domain": "vpsace.com",
    "type": "business",
    "network": "107.174.138.128 - 107.174.138.255",
    "netname": "CC-107-174-138-0-25"
  },
  "abuse": {
    "name": "VPS ACE",
    "address": "350 Main Street, Buffalo, NY, 14202, US",
    "email": "support@vpsace.com",
    "phone": "+1-855-587-7223"
  },
  "asn": {
    "asn": 36352,
    "abuser_score": "0.0374 (High)",
    "route": "107.174.138.0/24",
    "descr": "AS-COLOCROSSING - HostPapa, US",
    "country": "us",
    "active": true,
    "org": "HostPapa",
    "domain": "hostpapa.com",
    "abuse": "net-abuse-global@hostpapa.com",
    "type": "hosting",
    "created": "2005-12-12",
    "updated": "2024-01-04",
    "rir": "ARIN"
  },
  "location": {
    "is_eu_member": false,
    "calling_code": "1",
    "currency_code": "USD",
    "continent": "NA",
    "country": "United States",
    "country_code": "US",
    "state": "New York",
    "city": "Buffalo",
    "latitude": 42.88645,
    "longitude": -78.87837,
    "zip": "14205",
    "timezone": "America/New_York",
    "local_time": "2026-08-01T14:32:13-04:00",
    "local_time_unix": 1785609133,
    "is_dst": true,
    "utcoffset": "-04:00",
    "accuracy": "VERY_HIGH"
  },
  "elapsed_ms": 0.05
}

• Always present: ip, rir, the is_* flags, company and location (null when unknown).
• Present only when they apply: vpn, egress_service, datacenter, abuse and asn.
• elapsed_ms is only added to GET requests.
• A bogon address (private or reserved) returns only ip, rir and the flags.

# Top-Level Fields

# is_anycast

The same address is announced from many sites and each client reaches the nearest one, as with public DNS resolvers, root name servers and CDN edges: 1.1.1.1, 8.8.8.8 or 9.9.9.9. Such an address has no single location, so its location.accuracy is always VERY_LOW. The flag covers IPv4 /24 and IPv6 /48 prefixes that daily measurements from many vantage points saw answering from several sites on most days of the past week.

# is_crawler

false, or the name of the crawler or bot that operates from this address, for example GoogleBot (66.249.70.224), BingBot (40.77.190.180), DuckDuckGoBot (40.76.173.151), YandexBot (213.180.203.183) or TwitterBot (199.59.148.0).

Several hundred names occur. The most common are GoogleBot, AhrefsBot, ByteSpider, AppleBot, ClaudeBot, ChatGPTUser, AmazonBot, FacebookBot, YandexBot, BingBot, DuckDuckGoBot, BaiduSpider, UptimeRobot and StripeWebhook. Not all of them are search engines: SEO and AI crawlers, uptime monitors, webhooks and scrapers are listed too. To let good bots through, allow the names you trust rather than every truthy value.

# is_datacenter

true when the address belongs to a hosting provider; the datacenter object then names it. We count as hosting every organization that lets anyone rent servers or addresses quickly: hosting and cloud providers (Hetzner, AWS, Azure), CDNs (Cloudflare, Fastly), DDoS protection (DDoS-Guard, Qrator), IP leasing (IPXO) and app platforms (fly.io, Heroku). A true here is reliable.

Two exceptions: secure web gateways (Zscaler, Netskope) and satellite ISPs (Starlink, Viasat) are false even though they look like datacenter space, because their traffic comes from real users; egress_service identifies them. Privacy relays (iCloud Private Relay, Cloudflare WARP) are true and also carry an egress_service. See the list of hosting providers.

# is_proxy

true for known open proxies (HTTP, SOCKS4, SOCKS5) from public proxy lists, which we check continuously, and from feeds such as FireHOL's firehol_anonymous. Residential and mobile proxies are mostly not detected: they route through real users' devices, and no database knows an address is a proxy before it has been seen acting as one. To catch proxies while they are being used, see proxydetect.live.

# is_vpn

true when the address is a VPN exit node or server. Test it for truthiness (if (res.is_vpn)) rather than === true: a VPN record may carry a truthy value other than true. When the provider is known, the vpn object names it; addresses flagged by generic signals have no vpn object. For example, 67.170.172.12 is not a VPN and 187.13.12.227 is a NordVPN exit node.

We find exit nodes by connecting to VPN providers and recording the addresses their traffic leaves from (how), so coverage grows every day. See the list of VPN exit nodes.

# The vpn object

Present when the VPN provider is known. For an exit node or server we enumerated (example 187.13.12.227):

"vpn": {
  "ip": "187.13.12.227",
  "service": "NordVPN",
  "url": "https://nordvpn.com",
  "type": "exit_node",
  "last_seen": 1791556837158,
  "last_seen_str": "2026-10-09T14:40:37.158Z",
  "exit_node_region": "France #1354",
  "country_code": "FR",
  "city_name": "Bordeaux",
  "latitude": 44.84048,
  "longitude": -0.58079
}

Ranges we attribute to a provider because its enumerated exit nodes cluster there return a shorter object (example 45.86.210.136). When several providers share a range, service names all of them, joined with " + ":

"vpn": {
  "is_vpn": true,
  "service": "NordVPN",
  "url": "https://nordvpn.com"
}

Only service is always present; read the other fields defensively.

# The egress_service object

Present when the address is an egress node of a managed service: its traffic comes from that service's users, not from the organization that owns the address. type is the kind of service, provider the operator:

"egress_service": {
  "type": "secure_web_gateway",
  "provider": "Zscaler"
}

# The datacenter object

Present when is_datacenter is true:

"datacenter": {
  "datacenter": "HostPapa",
  "domain": "hostpapa.com",
  "network": "107.172.0.0 - 107.175.255.255"
}

Large clouds add fields from the ranges they publish: Amazon AWS adds region, service and network_border_group (3.5.140.2), DigitalOcean adds code, city, state and country (167.99.241.130), Linode adds name, city and country (72.14.182.54).

# The company object

"company": {
  "name": "VPS ACE",
  "abuser_score": "0.1016 (High)",
  "domain": "vpsace.com",
  "type": "business",
  "network": "107.174.138.128 - 107.174.138.255",
  "netname": "CC-107-174-138-0-25"
}

The organization the address is registered to, from the most specific WHOIS record covering it. In this example that is the customer VPS ACE, not HostPapa, which holds the surrounding /14; use all_companies=1 to get both. null when no record is known.

Organization types, used by company.type and asn.type:

# The abuse object

"abuse": {
  "name": "VPS ACE",
  "address": "350 Main Street, Buffalo, NY, 14202, US",
  "email": "support@vpsace.com",
  "phone": "+1-855-587-7223"
}

Where to report abuse from this address: the abuse contact of the WHOIS record in company, so it covers the same network. Present when that record has one. All four fields, the contact's name, postal address, email and phone, are strings.

# The asn object

"asn": {
  "asn": 36352,
  "abuser_score": "0.0374 (High)",
  "route": "107.174.138.0/24",
  "descr": "AS-COLOCROSSING - HostPapa, US",
  "country": "us",
  "active": true,
  "org": "HostPapa",
  "domain": "hostpapa.com",
  "abuse": "net-abuse-global@hostpapa.com",
  "type": "hosting",
  "created": "2005-12-12",
  "updated": "2024-01-04",
  "rir": "ARIN"
}

The autonomous system announcing the address, from BGP routing data and the AS's WHOIS record. Absent when no AS announces the address.

# Querying an ASN

Send an AS number as q (?q=AS15169&key=your_api_key) to look up the AS itself; this needs a key. The response has the fields of the asn object at the top level, without route, plus every prefix the AS announces:

{
  "asn": 15169,
  "abuser_score": "0.0012 (Low)",
  "descr": "GOOGLE - Google LLC, US",
  "country": "us",
  "active": true,
  "org": "Google LLC",
  "domain": "google.com",
  "abuse": "network-abuse@google.com",
  "type": "hosting",
  "created": "2000-03-30",
  "updated": "2012-02-24",
  "rir": "ARIN",
  "prefixes": ["8.8.4.0/24", "8.8.8.0/24", "... 1140 in total"],
  "prefixesIPv6": ["2001:4860::/32", "2001:4860:4820::/48", "... 146 in total"],
  "elapsed_ms": 1.21
}

Inactive ASes carry fewer fields. An AS number we have no data for returns 200 with {"error": "No data for ASN 4294967290"} and no error_code.

# The location object

"location": {
  "is_eu_member": false,
  "calling_code": "1",
  "currency_code": "USD",
  "continent": "NA",
  "country": "United States",
  "country_code": "US",
  "state": "New York",
  "city": "Buffalo",
  "latitude": 42.88645,
  "longitude": -78.87837,
  "zip": "14205",
  "timezone": "America/New_York",
  "local_time": "2026-08-01T14:32:13-04:00",
  "local_time_unix": 1785609133,
  "is_dst": true,
  "utcoffset": "-04:00",
  "accuracy": "VERY_HIGH"
}

Where the address is, from our own geolocation database. null when the address cannot be located.

# Data Sources

---

• WHOIS records of the five RIRs and the national registries. Their bulk downloads are incomplete, so we also query millions of networks and ASNs one by one. This is where company, abuse and most of asn come from.
• BGP routing tables (APNIC) for the routes and prefixes of every AS.
• Hosting ranges that cloud providers publish (Google Cloud, Azure, AWS and many more), WHOIS data, and an automatic classification of millions of organization websites.
• VPN exit node enumeration: we connect to VPN providers and record the addresses their traffic leaves from (VPN detection).
• Abuse data from public blocklists such as FireHOL and ipsum, and from our own honeypots.
• Geolocation from our own database, built from WHOIS, RFC 8805 geofeeds, reverse DNS and latency measurements.
• Reverse DNS of the whole IPv4 address space, from our own crawl (Reverse DNS Database). It feeds VPN, mobile and geolocation detection.

# API Servers

---

Use api.ipapi.is. It sends each request to the nearest healthy server of our fleet in Europe, North America and Asia, and fails over automatically. The regional names de.ipapi.is, us.ipapi.is and sg.ipapi.is reach one server each and exist for diagnostics; pinning a client to one only costs latency and failover. The status page shows the health and response time of every server.

# Data Corrections

---

Found wrong data? Report it on the corrections page, or submit corrections through the API.

# IP Databases

---

The data behind the API is also sold as downloadable databases, for offline use or for importing into your own systems. The business subscription includes all of them, plus a self-hosted copy of the API, for less than buying them separately.