{
"success": true,
"data": {
"ip": "12.12.12.12",
"score": 35,
"risk_level": "medium",
"recommendation": "review",
"rules": [
{
"id": "IP_VPN_OR_PROXY",
"description": "IP address is associated with VPN, proxy, or anonymization service."
},
{
"id": "IP_HOSTING",
"description": "IP address belongs to hosting or cloud provider ASN."
}
],
"security": {
"vpn_or_proxy": true,
"vpn_or_proxy_type": "Socks",
"tor": false,
"bot": false,
"relay": false,
"relay_country": null,
"relay_city": null,
"hosting": true,
"is_blacklisted": false
},
"custom_rules_applied": {
"total": 0,
"rules": []
}
},
"execution_ms": 90
}
{
"success": false,
"code": 101,
"type": "invalid_key",
"description": "The API Key is missing or invalid."
}
IP scoring
curl --request GET \
--url https://v2.greipapi.com/score/ip/{ip} \
--header 'Authorization: Bearer <token>'import requests
url = "https://v2.greipapi.com/score/ip/{ip}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://v2.greipapi.com/score/ip/{ip}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://v2.greipapi.com/score/ip/{ip}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://v2.greipapi.com/score/ip/{ip}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://v2.greipapi.com/score/ip/{ip}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://v2.greipapi.com/score/ip/{ip}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body
{
"success": true,
"data": {
"ip": "12.12.12.12",
"score": 35,
"risk_level": "medium",
"recommendation": "review",
"rules": [
{
"id": "IP_VPN_OR_PROXY",
"description": "IP address is associated with VPN, proxy, or anonymization service."
},
{
"id": "IP_HOSTING",
"description": "IP address belongs to hosting or cloud provider ASN."
}
],
"security": {
"vpn_or_proxy": true,
"vpn_or_proxy_type": "Socks",
"tor": false,
"bot": false,
"relay": false,
"relay_country": null,
"relay_city": null,
"hosting": true,
"is_blacklisted": false
},
"custom_rules_applied": {
"total": 0,
"rules": []
}
},
"execution_ms": 90
}
{
"success": false,
"code": 101,
"type": "invalid_key",
"description": "The API Key is missing or invalid."
}
Risk Scoring
IP Scoring
Access comprehensive threat intelligence data linked to a specific IP address. This endpoint provides insights into malicious activity, reputation scoring, and potential security risks associated with the IP address.
{
"success": true,
"data": {
"ip": "12.12.12.12",
"score": 35,
"risk_level": "medium",
"recommendation": "review",
"rules": [
{
"id": "IP_VPN_OR_PROXY",
"description": "IP address is associated with VPN, proxy, or anonymization service."
},
{
"id": "IP_HOSTING",
"description": "IP address belongs to hosting or cloud provider ASN."
}
],
"security": {
"vpn_or_proxy": true,
"vpn_or_proxy_type": "Socks",
"tor": false,
"bot": false,
"relay": false,
"relay_country": null,
"relay_city": null,
"hosting": true,
"is_blacklisted": false
},
"custom_rules_applied": {
"total": 0,
"rules": []
}
},
"execution_ms": 90
}
{
"success": false,
"code": 101,
"type": "invalid_key",
"description": "The API Key is missing or invalid."
}
GET
/
score
/
ip
/
{ip}
IP scoring
curl --request GET \
--url https://v2.greipapi.com/score/ip/{ip} \
--header 'Authorization: Bearer <token>'import requests
url = "https://v2.greipapi.com/score/ip/{ip}"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://v2.greipapi.com/score/ip/{ip}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://v2.greipapi.com/score/ip/{ip}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://v2.greipapi.com/score/ip/{ip}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://v2.greipapi.com/score/ip/{ip}")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://v2.greipapi.com/score/ip/{ip}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body
{
"success": true,
"data": {
"ip": "12.12.12.12",
"score": 35,
"risk_level": "medium",
"recommendation": "review",
"rules": [
{
"id": "IP_VPN_OR_PROXY",
"description": "IP address is associated with VPN, proxy, or anonymization service."
},
{
"id": "IP_HOSTING",
"description": "IP address belongs to hosting or cloud provider ASN."
}
],
"security": {
"vpn_or_proxy": true,
"vpn_or_proxy_type": "Socks",
"tor": false,
"bot": false,
"relay": false,
"relay_country": null,
"relay_city": null,
"hosting": true,
"is_blacklisted": false
},
"custom_rules_applied": {
"total": 0,
"rules": []
}
},
"execution_ms": 90
}
{
"success": false,
"code": 101,
"type": "invalid_key",
"description": "The API Key is missing or invalid."
}
Authentication
Include your API key in theAuthorization header:
Authorization: Bearer <api_key>
Path parameters
string
required
The IP address you want to retrieve threat intelligence for.Expected values: an IP address (IPv4 or IPv6)Sample value:
1.1.1.1Query parameters
string
default:"JSON"
The format command is used to get a response in a specific format.Expected values:
JSON, XML, CSV, or NewlineFor more information please refer to Response format.string
default:"live"
The mode command is used in the development stage to simulate the integration process before releasing it to the production environment.Expected values:
live, or test.For more information please refer to Development environment.string
Optional label for your own analytics or support correlation (for example a product or channel name).
string
The user_id command can be used to identify requests sent by specific users to monitor in the Events page.Expected values: email address, phone number, user id, name, etc.For more information please refer to User identifier.
Response properties
boolean
required
true when the request succeeded; false on error.object
required
Hide properties
Hide properties
string
required
IP address you’re looking up.
integer
required
Composite threat score from 0 to 100 derived from the
security module.A higher score means higher risk.string
required
Risk band (
low, medium, or high) from the composite score.string
required
Suggested action (
accept, review, or reject).array
required
Each object has
id and description. The array lists only signals that fired for this request (empty when none apply).Show Rule ids
Show Rule ids
| Id | Description |
|---|---|
IP_BLACKLISTED | IP address is on a Greip threat list or your custom blocklist. |
IP_TOR | IP address is a known Tor exit node. |
IP_VPN_OR_PROXY | IP address is associated with VPN, proxy, or anonymization service. |
IP_RELAY | IP address matches a private relay or similar anonymization pattern. |
IP_BOT | Request user-agent matches automated bot patterns. |
IP_HOSTING | IP address belongs to hosting or cloud provider ASN. |
object
required
Show details
Show details
boolean
required
Indicates if the IP address is a proxy service.
string
required
Type of proxy used.
boolean
required
Indicates if accessed through Tor network.
boolean
required
Indicates if the user is a bot.
boolean
required
Indicates if it’s a Apple’s Private Relay connection.
string
Country code for Apple Private Relay when detected; otherwise
null.string
City for Apple Private Relay when detected; otherwise
null.boolean
required
Indicates if the IP address belong to a hosting provider.
boolean
required
Indicates if the IP address is blacklisted due to applying custom
rules or were found in one of
your blacklists.
object
The custom rules applied to this request, learn
more.
integer
required
Time taken to process the request (milliseconds).
Was this page helpful?