Lookup API
Look up an IP or domain.
The Lookup API returns provider, network type, ASN, country, behavior tags, and a 0 to 100 risk score for one IP or domain. Use it inside fraud checks, login rules, abuse review, or enrichment jobs.
GET one address
/api/v4/ip/66.249.66.1 - Classification
- Verified crawler
- Provider
- Googlebot
- Risk score
- 38 / 100
- Response shape
- Network + behavior
Sample response
Run one lookup and see the fields.
This synthetic example uses a reserved documentation address to show the Lookup API response shape: provider, network type, ASN, country, behavior tags, and a 0 to 100 risk score.
GET /lookup/ip/198.51.100.42curl -G https://api.synthient.com/api/v4/lookup/ip/198.51.100.42 \-H "x-api-key: $SYNTHIENT_API_KEY"
ASN, ISP, network type, and any published abuse contacts for the address.
Drop it in
Use the same response across your systems.
Responses are flat, typed, and stable. They can be stored with login events, fraud decisions, abuse tickets, or warehouse enrichment jobs.
curl -G https://api.synthient.com/api/v4/lookup/ip/198.51.100.42 \-H "x-api-key: $SYNTHIENT_API_KEY"
Response fields
Stable fields, documented once.
Lookup responses, Parquet feeds, and NDJSON streams use the same provider, network, behavior, and risk fields. Teams can join live decisions to later investigations.
Who owns and operates the address.
- asn int
- Autonomous system number routing the address
- isp string
- Network operator name
- type string
- RESIDENTIAL, MOBILE, HOSTING, BUSINESS, and more
- org / domain string | null
- Registered organization and reverse DNS domain
- abuse_email / abuse_phone string | null
- Published abuse contacts when available
Where the address resolves.
- country / state / city string
- Resolved geography for the address
- timezone string
- IANA timezone identifier
- latitude / longitude number
- Approximate coordinates
- geo_hash string
- Geohash bucket for coarse joins
What Synthient has observed.
- risk_score int 0-100
- Score derived from observed behavior
- behavior string[]
- Observed behavior signals
- categories string[]
- Network classifications such as RESIDENTIAL_PROXY
- devices object[]
- Device OS fingerprints with last_seen
- providers object[]
- Proxy and VPN provider attribution with last_seen
Endpoints
| Method | Path | Purpose |
|---|---|---|
| GET | /api/v4/lookup/ip/{ip} | Single IPv4 or IPv6 lookup |
| POST | /api/v4/lookup/ips | Batch up to 1,000 addresses, billed ceil(n x 0.9) |
Status codes
| Code | Status | Meaning |
|---|---|---|
| 200 | OK | Lookup resolved |
| 400 | Bad request | Malformed IP or domain |
| 401 | Unauthorized | Missing or invalid x-api-key |
| 402 | Payment required | Insufficient credits on the key |
| 403 | Forbidden | Key lacks the required scope |
| 429 | Too many requests | Rate limited, honor the Retry-After header |
| 500 | Server error | Retry with exponential backoff |
Try it live
Run a sample IP lookup.
Use the public demo to see the response shape before you request an API key.