canonical: https://jentic.com/apis/ip99.com/ip99 # IP99 IP risk and geolocation API The IP99 IP risk and geolocation API tells you whether an IP address is currently proxy, VPN, dial-up pool, cloud phone, or datacenter infrastructure, how fresh that evidence is, and which network and location it belongs to. Each lookup returns a risk object with score, level, and the signals that fired, an evidence_state that separates no evidence from expired evidence, the network's ASN and usage_type, and geolocation at city level for every country and down to the district for addresses in China. A professional-tier lookup adds per-evidence detail, a sharing tier, and resource pools, and can return the verdict as it stood at a past moment. ## For AI agents Check an IP address for proxy, VPN, datacenter, dial-up pool, or cloud phone use, read how fresh the evidence is, and get its ASN and city-level location. ## Scope Does not handle blocking traffic, firewall rules, or email and phone reputation. Use for IP risk verdicts and IP geolocation lookups only. ## Capabilities - Check whether an IP address is a proxy, VPN, dial-up pool, cloud phone, or datacenter address - Read evidence_state before risk.score to tell no evidence from stale evidence - Get the network ASN and usage_type plus city, region, and timezone for an IP - Pull per-evidence detail with freshness and captured_at on the professional tier - Replay an IP's verdict as of a past moment with the at parameter - Check the current tier, remaining quota, and reset time for your key ## Use cases ### AI fraud-review agent screening signups A developer's agent connected through Jentic finds the IP99 lookup by intent and calls it with the key injected at execution time when one is configured. For each new signup it reads evidence_state first, then risk.level and risk.signals, and flags accounts created from VPN, proxy, or datacenter addresses for manual review, without the key entering the agent's context. Example prompt: Call GET `/v1/ip/{ip}` for the signup IP 203.0.113.7, and if evidence_state is not none and risk.level indicates risk, report the signals that fired ### Location and network context for a session Support and security tools often need to know where a session comes from and what kind of network it is on. The lookup returns geo fields including country, region, city, tz, lat, and lon, and network fields asn and usage_type, so a reviewer can see that a login moved from a residential ISP to a hosting provider. Example prompt: Call GET `/v1/ip/{ip}` for two login IPs and compare their country, city, and usage_type ### Investigating a past incident Risk verdicts change as evidence ages, so an incident review needs the verdict as it stood at the time. On the professional tier the pulse lookup accepts an at timestamp in RFC 3339 and returns the score, evidence list, and sharing tier relative to that moment. Example prompt: Call GET `/pulse/v1/ip/{ip}` with at '2026-10-01T09:00:00Z' and list each evidence item's risk_type and freshness ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | `/v1/ip/{ip}` | Risk verdict, network, and location for an IP | | GET | `/pulse/v1/ip/{ip}` | Professional verdict with per-evidence detail | | GET | `/v1/me` | Current tier and remaining quota | ## Key resources - **IP lookup** — Risk verdict, evidence state, network, and geolocation for one IP address - **Professional lookup** — Per-evidence detail, sharing tier, resource pools, and point-in-time verdicts - **Account** — Current tier, quota usage, and reset time for your key ## AI readiness This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use. - **Score:** 54 / 100 - **Maturity:** Foundational - **Dimensions:** - Foundational Compliance: 100 / 100 - Developer Experience & Jentic Compatibility: 70 / 100 - AI-Readiness & Agent Experience: 45 / 100 - Agent Usability: 94 / 100 - Security: 55 / 100 - AI Discoverability: 21 / 100 - **View full report:** https://jentic.com/apis/ip99.com/ip99/scorecard - **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/ - **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview ### Score it yourself Every API in the directory is allowlisted, so you can re-score it with no key required. - **Score your own API:** https://jentic.com/scorecard.md - **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md ```sh npx @jentic/api-scorecard-cli score ``` ## Why Jentic - **Setup:** Wiring IP99 by hand means choosing between the X-API-Key header and bearer form, keeping the key out of the query string where it is rejected, and knowing which lookups need a professional-tier key. Through Jentic you install once, import IP99 from the API Directory, store the key once, and your agent calls it. - **Permission scoping:** IP99 is a read-only lookup API with the address in the URL path (`/v1/ip/{ip}`), so a rule can bound your agent to the standard lookup operation. You choose the operations it may call, so the professional pulse lookup and the account quota read are not included unless you add them. - **Credential handling:** Your IP99 API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'check if an IP is a VPN' or 'locate an IP address', and Jentic returns the matching IP99 operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **ipdata** — IP geolocation with threat and proxy flags - **AbuseIPDB** — Community-reported IP abuse database - **MaxMind** — GeoIP and minFraud services - **Kickbox** — Email address verification ## FAQ ### What authentication does the IP99 API use? Per its OpenAPI spec, IP99 accepts an API key either in the `X-API-Key` header or as `Authorization: Bearer` with the same key, and never in the query string. GET `/v1/ip/{ip}` also works without a key at the free allowance, while GET `/v1/me` and the professional GET `/pulse/v1/ip/{ip}` require a key. Through Jentic the key is stored by your own instance and attached at call time. ### What are the rate limits for the IP99 API? The OpenAPI spec states that GET `/v1/ip/{ip}` without a key allows 1000 lookups per day per client IP and 60 per minute, and that a free account raises the daily allowance. GET `/v1/me` returns your key's per_min and per_day limits, used_today, and remaining quota. ### Does a risk score of 0 mean an IP is safe? No. The spec says to read evidence_state before risk.score: a score of 0 with evidence_state none means there is no evidence, not that the address is safe, and stale means evidence existed and expired. The score measures the freshness and strength of verifiable evidence, not a probability, so query at decision time rather than caching verdicts. ### Is there an IP99 MCP server? You don't need an MCP server to give your agent IP99. Jentic connects it directly from the API Directory: import it, store your API key once, and your agent calls the lookup operations it needs, discovered on demand rather than loaded into its context. ### Can I limit what my agent is allowed to do with IP99? Yes. For example, write a rule that allows only GET `/v1/ip/{ip}`, so the agent can run standard lookups but cannot call the professional pulse lookup or read your account quota, and every call it makes is logged. ### How do I check an IP for VPN use through Jentic? Import IP99 from the Jentic API Directory and store your API key once. Your agent searches for 'check if an IP is a VPN or proxy', gets GET `/v1/ip/{ip}` with its schema, and reads evidence_state and risk from the response. To run it on your own infrastructure, install Jentic One from its GitHub repo.