---
title: "Retrieve details for an IP address"
method: GET
path: "/ip"
tags: ["ips"]
---

# Retrieve details for an IP address

`GET /ip`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/ip`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/ip/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the details of the IP address. It will return 422 when requesting details of an inactive IP address.

Required API key permissions: `BreachRisk` (select when creating API key in Account Settings)

## Query parameters

- `ip` string, required

## Response `200`

IP details

- GetIpDetailsV1RespBody
  - `as_name` string: The name of the AS the IP belongs to. If no AS is available for an IP this field will be omitted.
  - `asn` integer: The ASN the IP belongs to. If no ASN is available for an IP this field will be omitted.
  - `automated_score` integer: The score of the ip. If the ip is inactive or hasn't been scanned yet this field will be absent
  - `check_results` CheckResult[]: The results of the IP scan. This field will be omitted if the IP has not been scanned or no results are available, e.g. DNS source IP.
    - `actual` Property[]: The found properties of the check
      - `property` string: The name of the property
      - `value` string: The value of the property
    - `category` string: Category values cannot be changed after first use, as they're referenced in storage.
    - `checked_at` string, date-time: The time the check was performed in RFC3339 format
    - `description` string: The description of the check performed
    - `expected` Property[]: The expected properties of the check
      - `property` string: The name of the property
      - `value` string: The value of the property
    - `id` string: The ID of the check
    - `pass` boolean: Flag indicating whether the check passed or not
    - `riskSubtype` string: The subtype of the risk, e.g. the subtype of the verified_vuln:CVE-2021-34473 is CVE-2021-34473. This field will be empty if the risk has no subtype, e.g. for wp_version_exposed, or for generic risks like verified_vuln:* where the subtype is only determined when the full risk is specified.
    - `riskType` string: The type of the risk, e.g. the type of the verified_vuln:CVE-2021-34473 is verified_vuln
    - `severity` integer
    - `severityName` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The severity fo the risk in human-readable form
    - `sources` string[]: Sources contains information about the source of a check e.g. the IP addresses it was found on, or a domain name
    - `title` string: The title of the check
  - `country` string: The country the IP belongs to. If no country is available for an IP this field will be omitted.
  - `domains` DomainScore[]: The list of domains associated with this IP. This field will be omitted if no domains are associated with the IP.
    - `automated_score` integer: The score of the domain
    - `hostname` string: The hostname of the domain
  - `ip` string: The IP.
  - `labels` string[]: The labels associated with the IP.
  - `owner` string: The owner of the IP.
  - `services` string[]: The list of discovered services IP. If no services were detected for the IP this field will be omitted.
  - `sources` IPSource[]: The sources of the IP.
  - `waived_check_results` CheckResult[]: The waived risks for this IP. This field will be omitted if no waived risks are present.
    - `actual` Property[]: The found properties of the check
      - `property` string: The name of the property
      - `value` string: The value of the property
    - `category` string: Category values cannot be changed after first use, as they're referenced in storage.
    - `checked_at` string, date-time: The time the check was performed in RFC3339 format
    - `description` string: The description of the check performed
    - `expected` Property[]: The expected properties of the check
      - `property` string: The name of the property
      - `value` string: The value of the property
    - `id` string: The ID of the check
    - `pass` boolean: Flag indicating whether the check passed or not
    - `riskSubtype` string: The subtype of the risk, e.g. the subtype of the verified_vuln:CVE-2021-34473 is CVE-2021-34473. This field will be empty if the risk has no subtype, e.g. for wp_version_exposed, or for generic risks like verified_vuln:* where the subtype is only determined when the full risk is specified.
    - `riskType` string: The type of the risk, e.g. the type of the verified_vuln:CVE-2021-34473 is verified_vuln
    - `severity` integer
    - `severityName` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The severity fo the risk in human-readable form
    - `sources` string[]: Sources contains information about the source of a check e.g. the IP addresses it was found on, or a domain name
    - `title` string: The title of the check

## Other responses

- `403`: Your API key does not have permission to perform this action.
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)