AbuseIPDB API
Agent-ready OpenAPI document · curated by JenticSecurityThreat DetectionapiKey7 EndpointsREST
Know of an official OpenAPI document? Contribute it →
For Agents
Check whether an IP address has been reported for abuse, pull the reports filed against it and the current blacklist, and submit new abuse reports. Each check returns an abuse-confidence score.
Use for: Check whether this IP address has been reported for abuse, I need to look up the abuse-confidence score for a visitor's IP, Report an IP that is brute-forcing our login, Download the latest blacklist of high-confidence abusive addresses
Not supported: Does not handle IP geolocation, DNS lookups, or firewall configuration. Use for IP abuse reputation and reporting only.
Jentic publishes the only available OpenAPI specification for AbuseIPDB API, keeping it validated and agent-ready. The AbuseIPDB API checks IP addresses against a crowd-sourced database of abuse reports and returns an abuse-confidence score for each address. It covers single-address checks, CIDR network-block screening, a downloadable blacklist of the most-reported hosts, and single or bulk reporting so applications can warn the community about attacking IPs.
Install Jentic One Beta
Connect the AbuseIPDB API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AbuseIPDB API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fabuseipdb.com%2Fabuseipdb" | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fabuseipdb.com%2Fabuseipdb" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AbuseIPDB API.
Check any IPv4 or IPv6 address for its abuse-confidence score and recent report history
Screen an entire CIDR network block for previously reported hosts before allowing traffic
Download the current blacklist of the most-reported addresses for firewall or WAF ingestion
Report an attacking IP with category codes and a comment so other users are warned
Submit abuse reports in bulk from intrusion logs for high-volume detection pipelines
Clear your own earlier reports for a specific address when they were filed in error
Use Cases
Patterns agents use AbuseIPDB API for, with concrete tasks.
★ Agent-Driven IP Reputation Checks
An AI agent triaging security alerts can call the AbuseIPDB API to score each suspicious IP against the community abuse database before deciding whether to block it. The check returns an abuse-confidence percentage, the number of distinct reporters, and the country and ISP, so the agent escalates only genuine threats. Through Jentic the agent discovers the check operation by intent and runs it with the credential injected at call time.
Check the IP 192.0.2.1 and block it if its abuse-confidence score is above 75
Firewall Blocklist Automation
Security teams pull the AbuseIPDB blacklist on a schedule to feed a firewall or WAF with the most-reported malicious addresses. The blacklist returns addresses above a confidence threshold you choose, so you can tune how aggressive the deny list is. The result stays current without manual curation.
Download the blacklist at a 90 percent confidence threshold and export it as a firewall deny list
Community Abuse Reporting
When an application detects brute-force or scraping activity, it can report the offending IP to AbuseIPDB with one or more category codes and a short comment. Reported addresses raise the abuse-confidence score other users see, strengthening the shared dataset. Bulk reporting accepts many addresses at once for pipelines that process large intrusion logs.
Report 198.51.100.23 with the SSH brute-force category and a comment describing the attack
Key Endpoints
7 endpoints — jentic publishes the only available openapi specification for abuseipdb api, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
GET
/check
Check an IP address and get its abuse-confidence score
GET
/blacklist
List the most-reported addresses above a threshold
POST
/report
Report an abusive IP with category codes
GET
/reports
List reports filed against an address
POST
/bulk-report
Submit many abuse reports at once
GET
/check-block
Check a CIDR network block
GET
/check
Check an IP address and get its abuse-confidence score
GET
/blacklist
List the most-reported addresses above a threshold
POST
/report
Report an abusive IP with category codes
GET
/reports
List reports filed against an address
POST
/bulk-report
Submit many abuse reports at once
GET
/check-block
Check a CIDR network block
Why Jentic?
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the AbuseIPDB API by hand means registering for an API key, setting the Key header on every request, and parsing the confidence-score response yourself. Through Jentic you install once, import AbuseIPDB from the API Directory, store the key once, and your agent calls it.
Permission scoping
AbuseIPDB carries the IP address in the query string, not the URL path, so rules bound which operations the agent may call rather than which address. You choose the operations it may use, so reporting and clearing are not included unless you add them, leaving an agent that can only read reputation data.
Credential isolation
Your AbuseIPDB key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'check an IP for abuse' or 'download the abuse blacklist', and Jentic returns the matching AbuseIPDB operation with its input schema so the agent calls the right endpoint without reading the reference docs.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AbuseIPDB API through Jentic.
Why is there no official OpenAPI spec for AbuseIPDB API?
AbuseIPDB does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AbuseIPDB API via structured tooling. It is validated against the live API and kept up to date. To run it on your own infrastructure, install Jentic One from its GitHub repo.
Is there an AbuseIPDB MCP server?
You don't need an MCP server to give your agent the AbuseIPDB API. Jentic connects it directly from the API Directory: import it, store your API key once, and your agent calls the check and report operations. No extra server sits in your agent's context.
Can I limit what my agent is allowed to do with the AbuseIPDB API?
Yes. Write a rule that allows only the read operations, such as checking an address and downloading the blacklist, so the agent can screen traffic but cannot file or clear reports on your account. AbuseIPDB carries the IP address in the query string rather than the URL path, so rules bound which operations the agent may call. Every call it makes is logged.
What authentication does the AbuseIPDB API use?
The AbuseIPDB API authenticates with an API key sent in the Key request header, per its OpenAPI spec. Through Jentic the key is stored encrypted by your own Jentic One instance and injected when the agent makes a call, so it never appears in the agent's prompt or logs.
Can I check an entire network range with the AbuseIPDB API?
Yes. The network-block check screens a CIDR range and returns the reported addresses inside it along with their abuse-confidence scores, which is useful for vetting a hosting provider's subnet before allowing traffic from it.
What are the rate limits for the AbuseIPDB API?
The OpenAPI spec does not specify rate limits; AbuseIPDB applies daily check and report quotas that vary by plan. Check the current limits in the AbuseIPDB documentation at https://docs.abuseipdb.com before scaling an agent's usage.
How do I check an IP's reputation with the AbuseIPDB API through Jentic?
Search Jentic for 'check an IP address for abuse' and it returns the AbuseIPDB check operation with its input schema. Store your API key once, then your agent passes an address and reads back the abuse-confidence score and the number of recent reports.
GET STARTED