Scoring

Score an IP address

Detects VPNs, proxies, Tor exit nodes and datacenter ranges, and returns geo/ASN context plus reputation from LayerCall's first-seen network.

get/v1/score/ip

Request

  • Base URL: https://www.layercall.com
  • URL: https://www.layercall.com/v1/score/ip
  • Auth: one of:
    • API key in header x-api-key
    • HTTP bearer

Query parameters

ipstring required

IPv4 or IPv6 address. IPv4-mapped IPv6 (::ffff:1.2.3.4) is canonicalised.

strictness'lenient' | 'balanced' | 'strict'

Shifts the allow/review/block thresholds. Signals and risk_score are unchanged.

Response

Score

ipstring required
risk_scoreinteger required

0 = clean, 100 = certain fraud.

verdict'allow' | 'review' | 'block' required

Recommended action. Thresholds move with strictness.

first_seenstring date-time nullable

First time this value was seen across the LayerCall network.

times_seeninteger
abuse_reportsinteger

Confirmed-fraud reports from distinct accounts.

cachedboolean required

Served from cache. Cached lookups are never billed.

request_idstring required
warningstring

Present only when the input needs attention.

vpn_providerstring nullable

Name of the VPN operating this exit node (e.g. "NordVPN", "Mullvad", "Surfshark"), taken from the operator's own published server list. null when is_vpn was inferred from an ASN or third-party feed rather than confirmed by the operator — absence is not evidence the IP is not a VPN.

signals_unavailablestring[]

Signals that could not be measured on this request — e.g. ["tor", "vpn_providers"]. Absent entirely when every feed answered, so the happy-path shape is unchanged. Present means the score was built on incomplete data: a "clean" answer and a "we could not check" answer are otherwise identical.

hijacked_sourceunknown
processing_time_secnumber
billable_lookupsinteger

Example response

{
  "vpn_provider": "NordVPN",
  "processing_time_sec": 0.261,
  "billable_lookups": 1
}

Changes

No recorded changes to this operation across all 1 revision of this API.