canonical: https://jentic.com/apis/abuseipdb.com/abuseipdb

# AbuseIPDB API

Jentic publishes the only available OpenAPI specification for AbuseIPDB API, keeping it validated and agent-ready. The AbuseIPDB API checks IP addresses against a crowd-sourced database of abuse reports and returns an abuse-confidence score for each address. It covers single-address checks, CIDR network-block screening, a downloadable blacklist of the most-reported hosts, and single or bulk reporting so applications can warn the community about attacking IPs.

## For AI agents

Check whether an IP address has been reported for abuse, pull the reports filed against it and the current blacklist, and submit new abuse reports. Each check returns an abuse-confidence score.

## Scope

Does not handle IP geolocation, DNS lookups, or firewall configuration. Use for IP abuse reputation and reporting only.

## Capabilities

- Check any IPv4 or IPv6 address for its abuse-confidence score and recent report history
- Screen an entire CIDR network block for previously reported hosts before allowing traffic
- Download the current blacklist of the most-reported addresses for firewall or WAF ingestion
- Report an attacking IP with category codes and a comment so other users are warned
- Submit abuse reports in bulk from intrusion logs for high-volume detection pipelines
- Clear your own earlier reports for a specific address when they were filed in error

## Use cases

### Agent-Driven IP Reputation Checks

An AI agent triaging security alerts can call the AbuseIPDB API to score each suspicious IP against the community abuse database before deciding whether to block it. The check returns an abuse-confidence percentage, the number of distinct reporters, and the country and ISP, so the agent escalates only genuine threats. Through Jentic the agent discovers the check operation by intent and runs it with the credential injected at call time.

Example prompt: Check the IP 192.0.2.1 and block it if its abuse-confidence score is above 75

### Firewall Blocklist Automation

Security teams pull the AbuseIPDB blacklist on a schedule to feed a firewall or WAF with the most-reported malicious addresses. The blacklist returns addresses above a confidence threshold you choose, so you can tune how aggressive the deny list is. The result stays current without manual curation.

Example prompt: Download the blacklist at a 90 percent confidence threshold and export it as a firewall deny list

### Community Abuse Reporting

When an application detects brute-force or scraping activity, it can report the offending IP to AbuseIPDB with one or more category codes and a short comment. Reported addresses raise the abuse-confidence score other users see, strengthening the shared dataset. Bulk reporting accepts many addresses at once for pipelines that process large intrusion logs.

Example prompt: Report 198.51.100.23 with the SSH brute-force category and a comment describing the attack

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/check` | Check an IP address and get its abuse-confidence score |
| GET | `/blacklist` | List the most-reported addresses above a threshold |
| POST | `/report` | Report an abusive IP with category codes |
| GET | `/reports` | List reports filed against an address |
| POST | `/bulk-report` | Submit many abuse reports at once |
| GET | `/check-block` | Check a CIDR network block |

## Key resources

- **IP checks** — Score a single address or a CIDR block and read the reports filed against it
- **Blacklist** — Retrieve addresses whose abuse-confidence exceeds a chosen threshold
- **Reports** — File single or bulk abuse reports and clear your own earlier submissions

## Why Jentic

- **Setup:** Wiring the AbuseIPDB API by hand means registering for an API key, setting the Key header on every request, and parsing the confidence-score response yourself. Through Jentic you install once, import AbuseIPDB from the API Directory, store the key once, and your agent calls it.
- **Permission scoping:** AbuseIPDB carries the IP address in the query string, not the URL path, so rules bound which operations the agent may call rather than which address. You choose the operations it may use, so reporting and clearing are not included unless you add them, leaving an agent that can only read reputation data.
- **Credential handling:** Your AbuseIPDB key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'check an IP for abuse' or 'download the abuse blacklist', and Jentic returns the matching AbuseIPDB operation with its input schema so the agent calls the right endpoint without reading the reference docs.

## Related APIs

- **Shodan** — Shodan scans internet-exposed hosts and services rather than scoring reported abuse.
- **ipstack** — ipstack geolocates an IP address that AbuseIPDB has flagged.
- **ipapi** — ipapi returns location and network data for an IP the agent is screening.

## FAQ

### Why is there no official OpenAPI spec for AbuseIPDB API?

AbuseIPDB does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AbuseIPDB API via structured tooling. It is validated against the live API and kept up to date. To run it on your own infrastructure, install Jentic One from its GitHub repo.

### Is there an AbuseIPDB MCP server?

You don't need an MCP server to give your agent the AbuseIPDB API. Jentic connects it directly from the API Directory: import it, store your API key once, and your agent calls the check and report operations. No extra server sits in your agent's context.

### Can I limit what my agent is allowed to do with the AbuseIPDB API?

Yes. Write a rule that allows only the read operations, such as checking an address and downloading the blacklist, so the agent can screen traffic but cannot file or clear reports on your account. AbuseIPDB carries the IP address in the query string rather than the URL path, so rules bound which operations the agent may call. Every call it makes is logged.

### What authentication does the AbuseIPDB API use?

The AbuseIPDB API authenticates with an API key sent in the Key request header, per its OpenAPI spec. Through Jentic the key is stored encrypted by your own Jentic One instance and injected when the agent makes a call, so it never appears in the agent's prompt or logs.

### Can I check an entire network range with the AbuseIPDB API?

Yes. The network-block check screens a CIDR range and returns the reported addresses inside it along with their abuse-confidence scores, which is useful for vetting a hosting provider's subnet before allowing traffic from it.

### What are the rate limits for the AbuseIPDB API?

The OpenAPI spec does not specify rate limits; AbuseIPDB applies daily check and report quotas that vary by plan. Check the current limits in the AbuseIPDB documentation at https://docs.abuseipdb.com before scaling an agent's usage.

### How do I check an IP's reputation with the AbuseIPDB API through Jentic?

Search Jentic for 'check an IP address for abuse' and it returns the AbuseIPDB check operation with its input schema. Store your API key once, then your agent passes an address and reads back the abuse-confidence score and the number of recent reports.