iprisq API

A scoring service for IP addresses. Send an address, get back an abuse score, a recommendation your application can act on, and the signals that produced it.

Quickstart

Every response is scored by our own model. You are not querying a database of somebody else's fields — you are asking for a judgement.

# is this address safe to let through?
curl "https://iprisq.com/v1/score/185.220.101.1?key=YOUR_KEY"

{
  "ip": "185.220.101.1",
  "abuse_score": 84,
  "trust_score": 16,
  "risk_band": "critical",
  "recommendation": "block",
  "assurance": 92,
  "usage_class": "anonymiser_tor",
  "signals": [
    { "code": "detection_tor", "label": "Tor exit node", "impact": 41.4 },
    { "code": "attack_history", "label": "Attacks observed from this address", "impact": 6 }
  ]
}

Authentication

Pass your key any of three ways. Keys are secret — keep them server-side.

?key=YOUR_KEY
X-API-Key: YOUR_KEY
Authorization: Bearer YOUR_KEY

Score an address

GET /v1/score/{address}

Scores one IPv4 or IPv6 address. Omit the address to score the caller's own. Costs one query.

Parameter	Description
policy	`strict`, `balanced` (default) or `lenient` — see Risk policies.

Score in batches

POST /v1/score

Up to 100 addresses per request. Each address costs one query, and the batch is all-or-nothing against your remaining allowance. Invalid and private addresses come back with an error instead of a score, and still cost nothing extra.

curl -X POST "https://iprisq.com/v1/score?key=YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ips": ["8.8.8.8", "185.220.101.1"]}'

Score fields

Field	Meaning
abuse_score	0–100. How much risk this address carries right now.
trust_score	100 − abuse_score, for when a positive framing reads better.
risk_band	minimal low moderate high critical
recommendation	`allow`, `challenge` or `block`, under the policy you asked for.
assurance	0–100. How much weight to put on the verdict, given how recently and how confidently the behaviour was observed. A high score with low assurance deserves a challenge rather than a block.
usage_class	`consumer`, `business`, `datacenter`, `mobile`, `anonymiser_tor`, `anonymiser_vpn`, `anonymiser_proxy`, `compromised_host`, `automation`, `unclassified`.
fraud_indicators	Plain booleans to branch on without reading a score.
signals[]	Every factor that moved the score, with its numeric impact. Positive adds risk, negative removes it.
context	ASN, provider, network type and country — enough to make sense of the score.
score_version	Increments when the model changes. Pin it if you have tuned thresholds against a version.

Risk policies

The score is the same for everyone; the thresholds applied to it are yours to choose. A bank blocks what a forum tolerates.

Policy	Challenge at	Block at	Suits
strict	25	50	Payments, account takeover, anything with chargebacks
balanced	40	60	Signups, trials, general abuse prevention
lenient	55	80	Content platforms where false positives cost more than abuse

Limits & errors

Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset (seconds until 00:00 UTC).

Status	Meaning
401	Missing, unknown or deactivated key.
400	Malformed address, unknown policy, or a batch over the size limit.
429 rate_limited	Over your plan's per-second ceiling. Retry after a second.
429 quota_exceeded	Daily allowance spent. Resets at 00:00 UTC.
502	We could not score the address. Nothing is invented — retry or treat as unknown.

Refused requests never consume quota, so a burst of 429s costs you nothing.