API Reference

Returns nothing but the requesting client's own public IP address, as plain text (Content-Type: text/plain) — e.g. 73.9.114.155. Direct equivalent of ipinfo.io/ip: works identically from curl, Wget, HTTPie, or a plain browser visit (no User-Agent detection, unlike the curl ipto.to shortcut above), and renders as just the bare IP with no page chrome when opened in a browser.

No parameters, no query string. For the full geolocation/threat-intelligence object, use GET /v1/ip below instead. This route reads the connecting IP directly (no D1/KV lookup) and is not metered against the per-day request budget — see Rate limits.

Returns geolocation and threat intelligence for the requesting IP, including city-level data via the CF edge object.

No required parameters. Accepts ?lang=, ?fields=, ?format= — see Localization and Output formats below.

Look up any IPv4 address. City-level fields (city, state, postal_code, latitude, longitude, timezone) are populated when the IP falls within either of two merged geo datasets, IP2Location or MaxMind — check geo_precision in the response to see whether you got city or country-level data. timezone's format depends on which source matched (a UTC-offset string from IP2Location, an IANA name from MaxMind). IPv6 lookups currently return country-level data only.

The unified search endpoint behind the homepage search bar. Detects whether :query is an IP, an ASN (AS15169 or 15169), a 2-letter country code, an email, or a phone number, then aggregates every relevant check into one response. For an IP query this fans out — in parallel, server-side — to the primary IP lookup plus RPKI, IP-to-company, mobile-carrier, hosted-domains, and places, so a single search only draws one request against your daily rate-limit budget rather than one per feature.

Every sub-field degrades independently — a slow or failed upstream (RIPEstat, an RDAP server, crt.sh) shows up as that one field being null, never as the whole search failing. Only an invalid primary query (e.g. a malformed IP) returns an error status for the request as a whole.

Reverse DNS — a single live PTR lookup via DNS-over-HTTPS, not a domain-enumeration database. Returns null if the IP has no PTR record.

RPKI route-origin validation for an IP's currently-announced route, resolved live via RIPEstat (no ROA database ingested or kept in sync locally). status is only ever "valid", "invalid", or "unknown" — never synthesized from any other signal; any RIPEstat failure or timeout returns "unknown" with a reason string, not an error.

Explicit (ASN, prefix) RPKI validation — for when you already know the exact route you want checked, rather than the IP-derived convenience above.

Identifies the organization an IP is registered to by combining RDAP (structured WHOIS) registrant data with the ASN's own organization name into a categorical confidence, never a numeric score.

The underlying RDAP registration record itself — network block, registration/last-changed dates, and every contact RDAP has on file. Distinct from /company above, which reconciles this same registrant data against the ASN's org name into one confidence-scored answer; this endpoint returns the raw record as-is, closer to classic WHOIS output. IPv6 addresses are supported too.

Best-effort mobile-carrier identification for IPs classified as mobile networks, cross-referenced against an MCC/MNC operator directory. Deliberately has no single carrier field — see matched_carrier_entries and note below — since a bare carrier name would read as a live per-subscriber claim, which this data can't honestly support.

Finds domains associated with an IP via its reverse-DNS (PTR) hostname and certificate-transparency logs (crt.sh) — not a general reverse-IP lookup. The response's own limitations field spells out exactly what this can and can't find.

Batch lookup — up to 100 IPs per request, Pro/Enterprise only. Returns a keyed object with each IP as a key. Faster than sequential calls due to parallel cache and database reads. Each IP in the batch counts against your daily request budget, same as looking it up individually. Free-tier requests get a 403 — see pricing.

Look up an Autonomous System by number. Returns the org name, country, continent, IP range count, classification type, exchange rate, and locale reference data (languages, tld, capital, borders).

Reverse-geocodes an IP's existing city-level location, then returns nearby points of interest (restaurants, parks, schools, transit, notable landmarks), local crime data where a source exists (UK and US only), and an optional on-demand driving commute estimate.

Country-level aggregate statistics plus locale reference data (currency, exchange rate, languages, tld, capital, borders).

Parse a User-Agent string. Returns browser, OS, device type, and bot detection. Reads the caller's User-Agent header by default, or pass any string via ?ua=.

Validates and formats a phone number for free, always: region, line type, and E.164/national/international formatting via a self-hosted parser, no vendor call. When a per-IP/key monthly premium budget is available (100/month on Free, more on paid tiers — see pricing), the same request additionally returns a live carrier name, porting status, and a provider-classified phone type from a real-time carrier-lookup service — see source and the fields below. A localized country_name plus lang/lang_source are always included, regardless of tier — see Localization. Exhausting the premium budget, or any upstream issue, falls back seamlessly to the free fields above; the request never errors because of it. For a country-level network-operator reference instead of a per-number lookup, see GET /v1/carriers.

Batch validation. Every tier gets bulk access (unlike /v1/ip/bulk) — the per-tier batch cap is what keeps Free bounded, not a 403. Free: 10/request, 100/day. Pro: 100/request, 1,000/day. Enterprise: 1,000/request, 10,000/day. This budget is separate from your general daily request limit — see Rate limits.

Reference lookup: which mobile network operators (MCC/MNC) are known for a given country — not tied to any specific phone number. Sourced from a community-maintained MCC/MNC compilation (MIT-licensed, last synced 2026 — see docs repo for details); a static reference table, not a live feed, since numbering-plan assignments don't change often enough to warrant one.

Email syntax validation, a live MX-record check via DNS-over-HTTPS, and disposable/temporary-domain detection against a community-maintained blocklist (CC0-licensed, synced daily). Does not verify the mailbox itself exists — that requires an SMTP handshake this API doesn't perform (see the field reference below for exactly what has_mx does and doesn't prove).

Combines whichever of IP, email, phone, and User-Agent you provide into one 0–100 score — the one thing none of ip-api.com, ipapi.co, ipgeolocation.io, ipify.org, ipregistry.co, ip2location.io, AbstractAPI, IPLocate.io, or BigDataCloud offer as a single fused signal (checked directly). All four inputs are optional and independent — pass any subset. ip defaults to your own IP and ua to your own User-Agent header if omitted, same convention as GET /v1/ip and GET /v1/ua. A signal you don't pass is simply absent from the response, not scored as clean — its weight is redistributed across whichever signals you did provide.

Renders a URL in a real headless Chrome instance (Cloudflare Browser Rendering, not a third-party screenshot vendor) and returns a PNG. Internal/private targets (localhost, RFC 1918 ranges, link-local/cloud-metadata addresses) are rejected before the browser ever launches. Subject to Browser Rendering's own platform-level limits, which are much tighter than the rest of this API — expect this to throttle well before your regular daily request budget does on lower Cloudflare plans.

Identifies the language of a piece of text via local trigram-frequency analysis — no external vendor call, no AI-model inference, no logging. Input under 10 characters returns a null language; under ~30 characters can still return a best guess but reliable will be false.

Converts an amount between two currencies (154 supported) using the same daily reference-rate feed that already powers currency_code/exchange_rate_usd on every IP, ASN, and country lookup — exposed here as a standalone conversion endpoint instead of nested inside a geolocation response.

Full exchange-rate table (154 currencies) rebased against any supported currency, not just USD.

Daily reference-rate history for one currency pair, up to 90 days back — the data behind the rate-trend chart on the currency converter tool. Backfilled once, then appended to daily by the same cron that updates GET /v1/currency/convert. This is a single daily reference rate over time, not a bid/ask trading spread.

Current conditions — and, with detail=1, an hourly outlook and multi-day forecast — for a place name, postal code or "lat,lon" pair, or for lat + lon or an ip. US places are answered by the National Weather Service, everywhere else by MET Norway. Add include= for the full document with units, up to 9 days, sun and moon, official alerts and more — see the include card below. The weather-lookup tool additionally auto-detects the caller's own location client-side before ever calling this endpoint explicitly.

Live proxy to USPTO's Trademark Status & Document Retrieval (TSDR) system for case status by 8-digit serial number — a direct per-request call, not a cached or resold copy. Case-status data is a U.S. government work and public domain per USPTO's own terms of use, so every response carries a source/attribution field rather than caching or reselling it silently. Trademark logo/image data is deliberately out of scope — USPTO's terms carve image licensing out separately from the case-status text data this endpoint returns. Registration-number lookup isn't supported yet; only the serial-number path is documented by USPTO today. Try it on the Trademark Lookup tool.

Live proxy to USPTO's Patent File Wrapper API (Open Data Portal) for grant status by 7-8 digit utility patent number — a direct per-request call, not a cached or resold copy. The originally-targeted source (PatentsView's Search API) was confirmed shut down 2026-03-20; this proxies its live successor instead. Patent File Wrapper data is a U.S. government work and public domain per USPTO's own terms of use, so every response carries a source/attribution field. Scope is application/prosecution-centric — no citation graph, patent family, legal-status field, or images the way Lens.org, Espacenet, or Google Patents show. Coverage starts at applications filed in 2001. Design, plant, and reissue patents aren't supported yet; only utility patents by granted patent number. Try it on the Patent Lookup tool.

Paginated VPN, Tor, and threat intelligence feed. 200 entries per page. Each entry includes IP/CIDR, provider attribution, ISP, country, and classification type.

Metadata only — total entry count, per-source counts, and last sync time. Does not return IP data.

Paginated abusive network ranges. Scored 1-10 by cross-feed corroboration. Risk tiers: critical (8-10), high (5-7), medium (3-4).

Metadata only — total network count, per-source counts, risk tier breakdown, and last sync time.

Downloadable CSV export of the open datasets the API is already built on — same data, no new license. asn and ranges are always available; geo-city returns 503 until that source's dataset is active on a given deployment. geo-city exports one geo source's raw rows at a time, not a merged view — pass ?source=primary (default) or ?source=secondary.

Issues an API key instantly — no email, no signup. Every key starts on the Free tier (1,000 requests/day; bulk lookup not included). Pro and Enterprise keys unlock higher daily limits and bulk lookup (up to 100 IPs/request) — see pricing. Store the key — it can't be retrieved later.

Check how many requests a key has made. Pass the key on any /v1/* request via the X-API-Key header or ?api_key= to have it counted.

Abuse-report contact for the network that owns an IP, from RDAP: the RIR, the network handle, the covering CIDR and the abuse mailbox(es). Use it to know where to send a report.

available is false (with a failure reason) when the registry could not be reached.

The actual IP ranges announced by an ASN, paginated, each with its country and the hosting / mobile / residential / bot / blacklist flags.

Registry (RDAP) record for an ASN: handle, name, country, allocation type, registration dates, the RIR and its contacts.

available is false with a reason when the registry is unreachable.

Other ASNs likely related to this one: same registered organization first, then same country and type.

Where an ASN actually sits: city-level points geolocated from a sample of its largest ranges, plus the most common cities. Powers the distribution map on the ASN page.

A sample, not the full range list. Use /v1/asn/:asn/ranges for every range.

Domains hosted in an ASN, found by reverse-DNS (PTR) on a sample of its addresses. Each entry has the root domain, the PTR hostname and the sampled IP.

Sampled, so it is a hint about what the ASN hosts, not a complete list. For one IP use /v1/ip/:ip/hosted-domains.

BGP relationships for an ASN: peers, upstream providers and downstream customers, with counts.

available is false when the BGP data source could not be reached. Empty arrays with available: true mean none were reported for that ASN.

Directory of the IPv4 space: one entry per /8 block with how many ranges, countries and ASNs it holds and its top country. Start here, then drill down with /v1/ip-ranges/:a and /v1/ip-ranges/:a/:b.

The /16 blocks inside one /8 (for example 8.0.0.0/8), with the same per-block range, country and ASN counts.

The assigned ranges inside one /16 (for example 8.8.0.0/16), each with the ASN it belongs to, plus the per-block counts.

One slice of the Nearby payload for a coordinate, so a client can render each part as it arrives: reverse geocode, points of interest, or local crime statistics.

Driving time and distance between two points. A fast path: it skips the reverse geocoding and points-of-interest lookups that /v1/places/:ip does.

When no destination can be resolved the response has to: null, commute: null and a reason string.

The /v1/places/:ip payload anchored on a typed street address instead of an IP: geocode, locality, and an optional commute estimate.

found is false when the address could not be geocoded.

Address autocomplete: a handful of matching places for a partial address, optionally biased toward a point.

The full weather document, for a place name, postal code, coordinates or IP. Pick the blocks you need with include: current, hourly, daily, astro (sun and moon), solar, indicators, alerts, marine, air_quality, nowcast, or all. US places come from the National Weather Service, everywhere else from MET Norway; meta.source says which. Without include you get the simple { query, weather } shape documented above.

meta.coverage says which fields exist for the place: rain probability, gusts and thunder probability are US and Nordic only and are null (never zero) elsewhere. alerts are official warnings for the US and Norway; marine, air_quality and nowcast cover Norway and nearby waters only and say available: false elsewhere. Anything in meta.derived is an ipto.to estimate, and indicators are derived flags, not official warnings. Keep meta.attribution if you display the data (MET Norway data is CC BY 4.0).

ipto.to's own daily record for places that have been looked up: the highest high, lowest low and largest precipitation seen across the day's forecast snapshots. Only places already requested have data, and it builds up over time.

These are forecast snapshots, not station observations or reanalysis, so do not use them as observed history. 404 means no snapshots have been recorded for that place yet.

The available radar animation frames, oldest first, each with a Unix timestamp and the frame id to use in the radar tile URL.

A radar map tile (PNG) for one frame at a standard web-map z/x/y position. Proxied same-origin so a map can load it without a third-party request.

A satellite imagery map tile for a standard web-map z/x/y position, proxied same-origin.

Machine-readable OpenAPI 3.1 contract for /v1/email/:email, written so LLM and MCP agents can call the email endpoint without reading these docs.