Lookup API
Look up an IP or domain.
The Lookup API returns provider, network type, ASN, country, behavior tags, and a 0 to 100 risk score for one IP or domain. Use it inside fraud checks, login rules, abuse review, or enrichment jobs.
Run one lookup and see the fields.
The Lookup API returns the network behind an IP or domain: provider, network type, ASN, country, behavior tags, and a 0 to 100 risk score.
GET /lookup/ip/101.53.218.152curl -G https://api.synthient.com/api/v4/lookup/ip/101.53.218.152 \-H "x-api-key: $SYNTHIENT_API_KEY"
ASN, ISP, network type, and any published abuse contacts for the address.
Use the same response in every system.
Responses are flat, typed, and stable. They can be stored with login events, fraud decisions, abuse tickets, or warehouse enrichment jobs.
curl -G https://api.synthient.com/api/v4/lookup/ip/101.53.218.152 \-H "x-api-key: $SYNTHIENT_API_KEY"
Stable fields, documented once.
Lookup responses, Parquet feeds, and NDJSON streams use the same provider, network, behavior, and risk fields. Teams can join live decisions to later investigations.
Who owns and operates the address.
- asn int
- Autonomous system number routing the address
- isp string
- Network operator name
- type string
- RESIDENTIAL, MOBILE, HOSTING, BUSINESS, and more
- org / domain string | null
- Registered organization and reverse DNS domain
- abuse_email / abuse_phone string | null
- Published abuse contacts when available
Where the address resolves.
- country / state / city string
- Resolved geography for the address
- timezone string
- IANA timezone identifier
- latitude / longitude number
- Approximate coordinates
- geo_hash string
- Geohash bucket for coarse joins
What Synthient has observed.
- risk_score int 0-100
- Score derived from observed behavior
- behavior string[]
- Observed behavior signals
- categories string[]
- Network classifications such as RESIDENTIAL_PROXY
- devices object[]
- Device OS fingerprints with last_seen
- providers object[]
- Proxy and VPN provider attribution with last_seen
Endpoints
| Method | Path | Purpose |
|---|---|---|
| GET | /api/v4/lookup/ip/{ip} | Single IPv4 or IPv6 lookup |
| POST | /api/v4/lookup/ips | Batch up to 1,000 addresses, billed ceil(n x 0.9) |
Status codes
| Code | Status | Meaning |
|---|---|---|
| 200 | OK | Lookup resolved |
| 400 | Bad request | Malformed IP or domain |
| 401 | Unauthorized | Missing or invalid x-api-key |
| 402 | Payment required | Insufficient credits on the key |
| 403 | Forbidden | Key lacks the required scope |
| 429 | Too many requests | Rate limited, honor the Retry-After header |
| 500 | Server error | Retry with exponential backoff |
TRY IT LIVE
Run a sample IP lookup.
Use the public demo to see the response shape before you request an API key.