IP threat intelligence. In one call.
Analyze any IP address for trust score, VPN and Tor detection, ASN, country, and organization — all from a PostgreSQL-backed threat intelligence database. Single lookup or batch up to 100.
Live playground
Look up any IP address.
Enter an IPv4 or IPv6 address, or leave blank to analyze your own IP. Results come straight from the live API.
Enter an IP address above and click Look Up
Why IP Intelligence API
Everything you need to assess an IP.
Trust scoring (0–100)
Every IP gets a trust score from 0 (high-risk) to 100 (clean). Use it to gate actions, flag requests, or inform risk decisions downstream.
VPN & Tor detection
Identify traffic from VPN services and Tor exit nodes with dedicated boolean flags — key signals for fraud prevention and access control.
ASN & geo lookup
Returns the Autonomous System Number, country code, and organization name for every IP — no extra enrichment step required.
Batch up to 100 IPs
POST an array of up to 100 IPs and get back concurrent results with a summary breakdown of found, not-found, valid, and invalid addresses.
PostgreSQL threat database
Backed by a PostgreSQL threat intelligence database with real-time analysis. Results include a correlationId for every request.
Use your own IP
Omit the ip parameter on the GET endpoint and the API automatically uses the client's IP from request headers — handy for self-checks.
/api/v1/ip-intelligence
Endpoints, at a glance.
GET for single lookups and quick scripts. POST batch for high-volume analysis. Both return the same intelligence fields.
Single IP lookup
Analyze one IP address. Pass ip as a query param, or omit it to analyze the caller's IP from request headers.
Batch lookup (GET)
Comma-separated list of IPs in the ip query param. Up to 100 addresses. Returns the same result shape as POST batch.
Batch lookup (POST)
JSON body with an ip array of up to 100 addresses. Concurrent processing with per-result found/error flags.
Batch info
Returns batch processing configuration: max size, endpoint, example request, and response schema.
Service health
Status, service name, version, and timestamp. Good for uptime monitoring.
Prometheus metrics
Request counts, processing times, and lookup success/failure rates.
| Field | Type | Description |
|---|---|---|
| ip | string | The analyzed IP address (IPv4 or IPv6) |
| trust_score | integer | Trust assessment 0–100. Higher = safer. |
| is_vpn | boolean | True if the IP belongs to a known VPN service. |
| is_tor | boolean | True if the IP is a known Tor exit node. |
| asn | string | Autonomous System Number (e.g. "AS15169"). |
| country | string | Two-letter country code (e.g. "US"). |
| org | string | Organization that owns the IP (e.g. "Google LLC"). |
| correlationId | string | Unique request identifier for tracing. |
Requests & responses.
Single IP via GET. Batch via POST or comma-separated GET. Omit ip to analyze your own.
Pass any IPv4 or IPv6 address, or omit ip to use the caller's IP.
GET https://datpaq.com/api/v1/ip-intelligence?api_key=YOUR_API_KEY&ip=8.8.8.8
POST a JSON array, or GET with a comma-separated list. Both return the same shape.
POST https://datpaq.com/api/v1/ip-intelligence/batch
Content-Type: application/json
x-api-key: YOUR_API_KEY
{
"ip": ["8.8.8.8", "185.220.101.1", "1.1.1.1"]
}Error reference
Predictable errors, every time.
Every error response includes a correlationId for request tracing and a plain-English error field.
The ip parameter is not a valid IPv4 or IPv6 address. Validate format before sending.
POST batch requires ip to be a JSON array: {"ip": ["8.8.8.8", "1.1.1.1"]}.
More than 100 IPs in a single batch. Split into multiple requests of 100 or fewer.
At least one IP address is required in the batch array.
The requested IP is not in the threat intelligence database. Private/RFC-1918 ranges may not be indexed.
The requested path does not exist. Check the endpoint list for available routes.
Too many requests from this IP. Wait before retrying.
Unexpected server error during analysis. The correlationId in the response helps trace the issue.
Example error response (batch invalid IP)
{
"success": true,
"data": {
"summary": { "total_requested": 2, "valid_ips": 1, "invalid_ips": 1, ... },
"invalid_ips": [
{ "index": 1, "ip": "invalid.ip.address", "reason": "Invalid IP format" }
]
},
"correlationId": "req-123456789"
}Start analyzing IPs today.
One GET call returns trust score, VPN/Tor flags, ASN, country, and org. No setup required — just your API key and an IP address.