--- title: "Look up an IP address" method: POST path: "/ip" tags: ["IP"] --- # Look up an IP address `POST /ip` ## Request - Base URL: `https://app.1lookup.io/api/v1` - URL: `https://app.1lookup.io/api/v1/ip` - Auth: HTTP bearer Returns geolocation, connection type and proxy, VPN, Tor and datacenter flags with a fraud score. Costs 1 credit. ## Request body - object - `ip` string, required: IPv4 or IPv6 address. - `bypass_cache` boolean: Skip the 7-day result cache and run a fresh lookup. Also accepted as `bypassCache` or `forceFresh`, in the body or the query string. A cached result you ran yourself is free; a fresh lookup is charged as usual. ## Response `200` Lookup completed. `metadata.credits_used` says what it cost. - object - `success` true, required - `data` IpResult, required: IP address lookup result. `risk_assessment.fraud_score` is the headline number. - `request` LookupRequest, required - `id` string, uuid, required: Id of this lookup. - `type` string, required: Lookup type, such as `phone`, `email` or `hlr_lookup`. - `input` string, required: The input as it was looked up, after normalization. - `timestamp` string, date-time, required: When the lookup ran. - `processing_time_ms` integer, required: Server-side processing time, in milliseconds. - `risk_assessment` RiskAssessment - `fraud_score` number: 0 to 100, higher is riskier. Not returned by every product (phone validation has none). - `risk_level` 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required - `risk_factors` string[], required: Codes for what raised the risk, such as `NOT_REACHABLE`, `DISPOSABLE_EMAIL` or `NO_MATCH_FOUND`. - `confidence_level` number, required: 0 to 100. - `classification` object, required - `connection_type` 'RESIDENTIAL_ISP' | 'MOBILE_NETWORK' | 'DATACENTER' | 'CDN_NETWORK' | 'PUBLIC_DNS' | 'PROXY_SERVER' | 'UNKNOWN', required - `service_type` 'STANDARD_ISP' | 'HOSTING_SERVICE' | 'VPN_SERVICE' | 'PUBLIC_DNS' - `anonymity_level` 'NONE' | 'MEDIUM' | 'HIGH', required - `organization_type` 'ISP' | 'HOSTING_PROVIDER' | 'TECH_GIANT' - `residential_probability` number: 0 to 1. - `insights` object, required - `network` object, required - `isp` string - `org` string - `asn` string: Autonomous system, or Unknown. - `asn_reputation` 'EXCELLENT' | 'GOOD' | 'POOR' - `geographic` object - `datacenter_location` boolean - `vpn_exit_probability` number: 0 to 1. - `tor_exit_node` boolean - `hosting_facility` string - `location` object, required - `city` string - `region` string - `country` string - `country_code` string - `latitude` number - `longitude` number - `timezone` string - `continent` string - `continent_code` string - `zip` string - `district` string - `security` object, required - `reputation_score` number - `tor_exit_node` boolean - `network_intelligence` object - `is_datacenter` boolean - `cloud_provider` string, nullable: Cloud operator that owns the address, when it is a published cloud range. - `cloud_region` string, nullable - `cloud_service` string, nullable - `is_tor_exit` boolean - `verified_crawler` object, nullable: Set when a self-declared crawler really came from that operator's published ranges. - `operator` string - `bot` string - `is_bogon` boolean: A reserved or unroutable address. - `coverage` 'complete' | 'partial' | 'unavailable': How many of the network feeds were checked. - `checked_feeds` string[] - `missing_feeds` string[] - `data_as_of` string, nullable - `usage_patterns` object - `likely_automation` boolean - `api_usage` boolean - `human_probability` number: 0 to 1. - `business_usage` boolean - `recommendations` Recommendations, required - `primary_action` 'APPROVE' | 'VERIFY' | 'REVIEW' | 'BLOCK', required - `secondary_actions` string[], required - `user_message` string, required: One plain sentence describing the result. - `business_rules` object, required: Product-specific yes/no rules, such as `sms_allowed` and `voice_allowed` for a phone number. - `metadata` LookupMetadata, required - `api_version` string, required - `schema_version` string, required - `credits_used` integer: Credits this call cost. 0 for a no-match on success-billed products, and for a cached result you ran yourself. - `credits_remaining` integer: Credits left on the account after this call. - `cache_hit` boolean, required: True when the result came from the 7-day cache. - `cached_at` string, date-time: When the cached result was first looked up. Only on cache hits. - `data_sources` string[], required: Generic labels for the kinds of data consulted. - `fallback_used` boolean: Email verification only: a second verification ran. - `lookup_source` 'standard' | 'premium': Reverse phone lookup only: which record was read. ## Other responses - `400`: `INVALID_REQUEST`: The body is not valid JSON; `MISSING_FIELD`: The request field is missing; `INVALID_INPUT`: The input is not a string, or does not match the expected format; `VALIDATION_FAILED`: The lookup could not be completed for this input. Nothing was charged; `UPSTREAM_ERROR`: The source could not answer for this input. Nothing was charged - `401`: `UNAUTHORIZED`: Invalid or missing API key - `402`: `INSUFFICIENT_CREDITS`: Not enough credits for the request - `403`: `UPGRADE_REQUIRED`: The account has no paid plan, and API access needs one. Upgrade at https://app.1lookup.io/billing?tab=plan - `429`: `RATE_LIMIT_EXCEEDED`: Too many requests - `500`: `INTERNAL_ERROR`: Internal server error - `503`: `SERVICE_UNAVAILABLE`: The lookup service, or the API key check, is temporarily unavailable. Nothing was charged; retry after `Retry-After` seconds; `SERVICE_BUSY`: The service is busy. Nothing was reserved or charged; retry after `Retry-After` seconds; `UPSTREAM_QUOTA_EXHAUSTED`: The lookup is temporarily unavailable on our side. Nothing was charged; retry after `Retry-After` seconds; `UPSTREAM_TIMEOUT`: The source took too long to answer. Nothing was charged; retry after `Retry-After` seconds --- [API](https://skmtc.dev/1lookup/apis/1lookup-api.md) · [All operations](https://skmtc.dev/1lookup/apis/1lookup-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1lookup/apis/1lookup-api/revisions/57b6d8ba04ac?raw)