---
title: "Get Ip Report"
method: GET
path: "/api/v3/ip_addresses/{ip}"
tags: ["Intelligence"]
---

# Get Ip Report

`GET /api/v3/ip_addresses/{ip}`

## Request

- Base URL: `https://ai.virustotal.com`
- URL: `https://ai.virustotal.com/api/v3/ip_addresses/{ip}`
- Auth: one of:
  - API key in header `x-apikey`
  - HTTP bearer

Query IP intelligence; VTAI does not send an explicit analysis POST.

This does not promise that VirusTotal's report retrieval has no upstream side effects.
Use the network submission flow to explicitly request reanalysis and retain a receipt.

## Path parameters

- `ip` string, required: IPv4 or IPv6, without a CIDR prefix, port, brackets or zone identifier

## Response `200`

Successful Response

- IPResponse
  - `data` IPData, required
    - `id` string, required: Canonical object identifier returned by VirusTotal
    - `source` 'VirusTotal'
    - `last_analysis_stats` object, nullable, required: Reported category counts; null when unavailable. Zero detections do not establish safety.
    - `detections` string[], required: Non-null result strings from engines, including clean/undetected labels; these are not engine names
    - `analysis_date` string, date-time, nullable, required: UTC last_analysis_date from VirusTotal, null if absent or invalid; never the lookup time
    - `report_url` string, required: Link to the existing VirusTotal report
    - `coverage` ReportCoverage, required
      - `engines` integer, nullable, required: Number of entries in last_analysis_results; null when unavailable
      - `categories` string[], required: Distinct categories actually present in last_analysis_results; not a safety verdict
    - `type` 'ip_address'
    - `ip` string, required: Canonical IPv4 or compressed lowercase IPv6 address, without a zone identifier

## Other responses

- `401`: Missing VTAI token
- `403`: Invalid VTAI token
- `404`: No report found; unavailable evidence is not a safe verdict
- `422`: Invalid lookup input
- `429`: Shared VTAI query quota or VirusTotal quota exceeded
- `502`: Invalid upstream response or upstream request rejected
- `503`: Access, quota or VirusTotal service unavailable
- `504`: VirusTotal timeout

---

[API](https://skmtc.dev/virustotal/apis/virustotal-ai-api.md) · [All operations](https://skmtc.dev/virustotal/apis/virustotal-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/virustotal/apis/virustotal-ai-api/revisions/3c7943feccc6?raw)