API Reference

Send a passwordless sign-in link to the given email address. The link expires after 15 minutes. Limited to 3 links per email address per 15 minutes.

{
  "email": "john@example.com"
}

{
  "message": "sign-in link sent to john@example.com"
}

Verify the magic link token from the email. This endpoint is opened by the browser, not called programmatically: on success it sets the ipcraft_session cookie and redirects (307) to the app. On first sign-in it creates the user and their organization. Invalid or expired tokens redirect to the login page with an error.

Start the Google OAuth sign-in flow. Redirects to Google; the callback (/api/v1/auth/oauth/google/callback) sets the session cookie and redirects to the app. Browser-only — not for programmatic use.

Returns the authenticated user, their organization, and their role (admin, editor, or viewer). Requires auth.

{
  "user": {
    "id": "7f3e9a12-4b6c-4d2e-9f01-8a5b3c7d1e42",
    "email": "john@example.com",
    "name": "John Smith",
    "email_verified": true,
    "created_at": "2026-03-01T12:00:00Z"
  },
  "organization": {
    "id": "c2a8f5d0-1e3b-4a7c-8d9e-0f1a2b3c4d5e",
    "name": "John Smith's Org",
    "slug": "john-smiths-org",
    "plan": "free",
    "created_at": "2026-03-01T12:00:00Z",
    "updated_at": "2026-03-01T12:00:00Z"
  },
  "role": "admin"
}

Destroys the current session and clears the session cookie. No request body required.

200 OK

Permanently deletes the authenticated user's account and clears the session.

{
  "message": "account deleted"
}

Returns all folders for the authenticated organization.

[
  {
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "name": "Production",
    "description": "Production network ranges",
    "sort_order": 0,
    "created_at": "2026-03-01T12:00:00Z"
  }
]

Create a new folder.

{
  "name": "Production",
  "description": "Production network ranges",
  "sort_order": 0
}

Only name is required. description and sort_order are optional.

Returns 201 with the created folder object.

Returns a single folder by ID.

Update a folder. All fields are optional — only provided fields are changed.

{
  "name": "Prod (US-East)",
  "description": "US East production ranges",
  "sort_order": 1
}

200 OK

Delete a folder. Subnets in the folder are kept and become unfoldered.

204 No Content

List all subnets, optionally filtered by folder. Includes utilization statistics and resolved VLAN/VRF/location/folder names. Not paginated.

• folder_id — filter by folder (optional)

[
  {
    "id": "b4c5d6e7-f8a9-0123-bcde-f01234567890",
    "folder_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "network": "10.0.0.0/16",
    "name": "Core network",
    "description": "Main production range",
    "vlan_id": null,
    "vrf_id": null,
    "location_id": null,
    "is_pool": false,
    "gateway": "10.0.0.1",
    "dns_primary": "10.0.0.53",
    "dns_secondary": null,
    "scan_enabled": false,
    "tracked": true,
    "utilization": 0.12,
    "used_count": 7860,
    "total_count": 65534,
    "folder_name": "Production",
    "created_at": "2026-03-01T12:00:00Z",
    "updated_at": "2026-03-01T12:00:00Z"
  }
]

Nullable/empty fields (parent_id, vlan_number, vrf_name, location_name, custom_fields, counts) are omitted when unset.

Create a new subnet. The parent is auto-detected based on CIDR containment (and existing subnets inside the new range are re-parented under it). Partial overlaps within the same VRF are rejected with 400; parent/child containment is allowed.

{
  "network": "10.0.1.0/24",
  "name": "Web servers",
  "description": "Web tier subnet",
  "folder_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "vlan_id": null,
  "vrf_id": null,
  "location_id": null,
  "gateway": "10.0.1.1",
  "dns_primary": "10.0.0.53",
  "dns_secondary": null,
  "is_pool": false,
  "tracked": true
}

Only network is required. All other fields are optional. tracked defaults to true when omitted; send false to create a structure-only container subnet that's excluded from utilization stats.

Returns 201 with the created subnet object. If the new subnet (created without a VRF) overlaps ranges that exist in other VRFs, the response is wrapped as {"subnet": {...}, "warnings": [{"id", "network", "name", "vrf_name"}]} — the create still succeeds.

Returns a subnet with utilization statistics and its child subnets.

{
  "id": "b4c5d6e7-f8a9-0123-bcde-f01234567890",
  "network": "10.0.0.0/16",
  "name": "Core network",
  "utilization": 0.12,
  "children": [
    {
      "id": "c5d6e7f8-a9b0-1234-cdef-012345678901",
      "network": "10.0.1.0/24",
      "name": "Web servers"
    }
  ]
}

Update subnet metadata. All fields are optional — only provided fields are changed. The network itself cannot be changed.

{
  "name": "Web servers (prod)",
  "description": "Production web tier",
  "folder_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "location_id": null,
  "vlan": "120",
  "vrf": "CORP",
  "is_pool": true,
  "tracked": false,
  "gateway": "10.0.1.1",
  "dns_primary": "10.0.0.53",
  "dns_secondary": null,
  "custom_fields": { "rack": "R12" }
}

Note: unlike create, update takes vlan as a VLAN number (1–4094) and vrf as a VRF name; both are auto-created if they don't exist, and an empty string clears the assignment.

200 OK

Delete a subnet. Cascades to all child subnets and addresses.

204 No Content

Split a subnet into equal parts. The number of parts must be a power of 2 (2, 4, 8, ... up to 1024). The new subnets inherit the original's folder, parent, name, VRF, and pool flag.

{
  "parts": 4
}

[
  { "id": "d6e7f8a9-...", "network": "10.0.0.0/26" },
  { "id": "e7f8a9b0-...", "network": "10.0.0.64/26" },
  { "id": "f8a9b0c1-...", "network": "10.0.0.128/26" },
  { "id": "a9b0c1d2-...", "network": "10.0.0.192/26" }
]

Returns utilization statistics for a subnet.

{
  "subnet_id": "c5d6e7f8-a9b0-1234-cdef-012345678901",
  "network": "10.0.1.0/24",
  "used": 42,
  "total": 254,
  "utilization": 0.165
}

Returns the first available IP address in the subnet, or null if the subnet is full.

{
  "ip": "10.0.1.5"
}

{
  "ip": null,
  "message": "no available addresses"
}

Finds unallocated child blocks of a requested size inside a subnet — the subnet-level counterpart of First Free IP. Returns the lowest free CIDR blocks of prefix length prefix that don't collide with any existing subnet in the same VRF (nested children are handled; supernets are ignored). prefix must be longer than the subnet's own prefix. limit caps the candidates returned (default 5, max 50); total is the count of all free blocks, and capped is true when the total hit the reporting cap of 1,000,000 (large IPv6 containers).

{
  "subnet_id": "c5d6e7f8-a9b0-1234-cdef-012345678901",
  "network": "10.0.0.0/16",
  "prefix": 24,
  "blocks": ["10.0.4.0/24", "10.0.5.0/24"],
  "total": 253,
  "capped": false
}

Returns all pairs of subnets whose CIDR ranges overlap, classified by overlap type: duplicate (same CIDR in different VRFs), containment (parent/child), or partial.

[
  {
    "subnet_a": { "id": "...", "network": "10.0.0.0/16", "vrf_name": "CORP" },
    "subnet_b": { "id": "...", "network": "10.0.0.0/16" },
    "type": "duplicate"
  }
]

List IP addresses in a subnet. Paginated: limit defaults to 1,000 (also the maximum); the total count is returned in the X-Total-Count response header.

[
  {
    "id": "0a1b2c3d-4e5f-6789-0abc-def123456789",
    "subnet_id": "c5d6e7f8-a9b0-1234-cdef-012345678901",
    "ip": "10.0.1.10",
    "hostname": "web-01.prod",
    "mac_address": "00:1a:2b:3c:4d:5e",
    "description": "Primary web server",
    "status": "assigned",
    "owner": "platform-team",
    "created_at": "2026-03-01T12:00:00Z",
    "updated_at": "2026-03-01T12:00:00Z"
  }
]

Optional fields (ptr_record, custom_fields, last_seen) are omitted when unset.

Assign an IP address within a subnet. The IP must fall inside the subnet's CIDR range and not already be assigned.

{
  "ip": "10.0.1.10",
  "hostname": "web-01.prod",
  "mac_address": "00:1A:2B:3C:4D:5E",
  "description": "Primary web server",
  "status": "assigned",
  "owner": "platform-team"
}

Only ip is required. status defaults to assigned.

Returns 201 with the created address object.

Assign up to 500 IPs in one request (e.g., reserve a range). status applies to all IPs and defaults to reserved.

{
  "ips": ["10.0.1.20", "10.0.1.21", "10.0.1.22"],
  "status": "reserved"
}

{
  "created": 3
}

Returns a single address by ID (same shape as the list items above).

Update address metadata. All fields are optional. The IP itself cannot be changed.

{
  "hostname": "web-01a.prod",
  "mac_address": "00:1A:2B:3C:4D:5F",
  "description": "Migrated web server",
  "status": "assigned",
  "owner": "platform-team",
  "custom_fields": { "asset_tag": "A-1042" }
}

200 OK

Remove an IP address assignment (release the IP).

204 No Content

Update the status and/or owner of up to 500 addresses at once.

{
  "ids": ["0a1b2c3d-...", "1b2c3d4e-..."],
  "status": "reserved",
  "owner": "network-team"
}

{
  "updated": 2
}

Release up to 500 addresses at once.

{
  "ids": ["0a1b2c3d-...", "1b2c3d4e-..."]
}

{
  "deleted": 2
}

A VLAN has a vlan_number (1–4094, required on create), optional name, description, and location_id. List responses include a computed subnet_count.

{
  "id": "2c3d4e5f-6789-0abc-def1-234567890abc",
  "vlan_number": 120,
  "name": "Web tier",
  "description": "Production web VLAN",
  "subnet_count": 3,
  "created_at": "2026-03-01T12:00:00Z"
}

A VRF has a name (required on create), optional rd (route distinguisher, e.g. 65000:1) and description. List responses include a computed subnet_count.

{
  "id": "3d4e5f67-890a-bcde-f123-4567890abcde",
  "name": "CORP",
  "rd": "65000:1",
  "subnet_count": 12,
  "created_at": "2026-03-01T12:00:00Z"
}

A location has a name (required on create) and optional address. List responses include computed subnet_count and vlan_count.

{
  "id": "4e5f6789-0abc-def1-2345-67890abcdef1",
  "name": "Datacenter US-East",
  "address": "Ashburn, VA",
  "subnet_count": 8,
  "vlan_count": 4,
  "created_at": "2026-03-01T12:00:00Z"
}

List all webhook subscriptions. The signing secret is never included in list responses.

[
  {
    "id": "5f678901-abcd-ef12-3456-7890abcdef12",
    "url": "https://example.com/webhooks/ipcraft",
    "description": "CMDB sync",
    "event_types": ["subnet.created", "subnet.deleted"],
    "is_active": true,
    "failure_count": 0,
    "created_at": "2026-03-21T16:00:00Z"
  }
]

Create a new webhook subscription. The URL must use HTTPS. Returns the signing secret — store it securely, it is only shown once.

{
  "url": "https://example.com/webhooks/ipcraft",
  "description": "CMDB sync",
  "event_types": ["subnet.created", "subnet.deleted"]
}

Leave event_types empty ([]) to receive all event types.

{
  "id": "5f678901-abcd-ef12-3456-7890abcdef12",
  "url": "https://example.com/webhooks/ipcraft",
  "secret": "whsec_a1b2c3d4e5f6...",
  "description": "CMDB sync",
  "event_types": ["subnet.created", "subnet.deleted"],
  "is_active": true
}

Get a single webhook subscription. The signing secret is not included.

Update a webhook's URL, description, event types, or active status.

{
  "url": "https://new-endpoint.example.com/hook",
  "event_types": ["address.created"],
  "is_active": true
}

200 OK

Permanently delete a webhook subscription and all its delivery history.

204 No Content

List recent delivery attempts for a webhook. Supports ?limit= (default 50, max 100) and ?offset= query parameters. Delivery records are retained for 7 days.

[
  {
    "id": "6789012a-bcde-f123-4567-890abcdef123",
    "event_type": "subnet.created",
    "response_status": 200,
    "duration_ms": 142,
    "attempt": 1,
    "delivered_at": "2026-03-21T16:30:00Z"
  }
]

Send a test ping event to the webhook endpoint. Returns the delivery result so you can verify connectivity.

{
  "event_type": "ping",
  "response_status": 200,
  "duration_ms": 95,
  "attempt": 1
}

Returns 502 if the endpoint is unreachable or returns a non-2xx status.

Generate a new signing secret for the webhook. The old secret stops working immediately.

{
  "secret": "whsec_new_secret_value..."
}

List all API keys. Only the key prefix is shown — the full key is never returned after creation.

[
  {
    "id": "789012ab-cdef-1234-5678-90abcdef1234",
    "name": "Ansible automation",
    "key_prefix": "ipc_a1b2c3d4",
    "permissions": ["read", "write"],
    "created_at": "2026-03-01T12:00:00Z",
    "last_used_at": "2026-03-14T09:15:00Z"
  }
]

Generate a new API key. The full key is only returned in this response — store it securely.

{
  "name": "Ansible automation",
  "permissions": ["read", "write"]
}

permissions is optional and defaults to ["read", "write"]. Use ["read"] for a read-only key.

{
  "id": "789012ab-cdef-1234-5678-90abcdef1234",
  "name": "Ansible automation",
  "key": "ipc_a1b2c3d4e5f6...(68 chars total)",
  "key_prefix": "ipc_a1b2c3d4",
  "permissions": ["read", "write"],
  "created_at": "2026-03-01T12:00:00Z"
}

Revoke an API key. Any requests using this key will immediately start returning 401.

204 No Content

[
  {
    "user_id": "7f3e9a12-4b6c-4d2e-9f01-8a5b3c7d1e42",
    "email": "john@example.com",
    "name": "John Smith",
    "role": "admin",
    "accepted_at": "2026-03-01T12:00:00Z"
  }
]

{
  "role": "editor"
}

{
  "message": "role updated"
}

Remove a member from the organization.

{
  "message": "member removed"
}

Email an invitation to join your organization. Returns 402 if you're at your plan's seat limit. Invitation creation is limited to 10 per organization per hour. The invitee accepts via the emailed link (GET /api/v1/auth/accept-invite?token=..., browser-only).

{
  "email": "teammate@example.com",
  "role": "editor"
}

Returns 201 with the invitation object (id, email, role, expires_at, created_at).

List pending invitations.

{
  "message": "invitation cancelled"
}

Returns current plan details, usage, and limits.

{
  "plan": "free",
  "org_name": "John Smith's Org",
  "has_billing": false,
  "usage": {
    "folders": 1,
    "subnets": 3,
    "addresses": 42
  },
  "limits": {
    "folders": 5,
    "subnets": 100,
    "addresses": 1500
  }
}

Creates a Stripe Checkout session for upgrading to Pro or Teams. Redirect the user to the returned URL. Returns 400 if the organization is already on a paid plan — use the Customer Portal to switch plans instead. For Enterprise, contact us.

{
  "plan": "pro"
}

plan is "pro" or "teams". Omitting the body defaults to "pro".

{
  "url": "https://checkout.stripe.com/c/pay/cs_live_..."
}

Creates a Stripe Customer Portal session for managing billing, invoices, and cancellation.

{
  "url": "https://billing.stripe.com/p/session/..."
}

Rename your organization (max 100 characters).

{
  "name": "Acme Networks"
}

200 OK

Create up to 1,000 subnets per request. Folders, VLANs, VRFs, and locations referenced by name/number are auto-created. Duplicates (same CIDR + VRF) and partial overlaps are skipped, not errored. Rows that would exceed plan limits are reported as errors; successfully imported rows are kept (no rollback).

{
  "subnets": [
    {
      "network": "10.0.1.0/24",
      "name": "Web servers",
      "folder": "Production",
      "vlan": "120",
      "vrf": "CORP",
      "location": "Datacenter US-East",
      "gateway": "10.0.1.1",
      "is_pool": false
    }
  ]
}

Only network is required per row. Also accepted: description, dns_primary, dns_secondary, scan_enabled, tracked (defaults to true when absent), custom_fields.

{
  "results": [
    { "row": 1, "status": "created", "id": "...", "network": "10.0.1.0/24" }
  ],
  "summary": { "created": 1, "skipped": 0, "errors": 0 }
}

Create up to 1,000 addresses per request. Each row needs ip and subnet (the parent CIDR, which must already exist). Also accepted: hostname, mac_address, description, status, owner, ptr_record, custom_fields. Already-assigned IPs are skipped. Same response shape as subnet import.

{
  "addresses": [
    {
      "ip": "10.0.1.10",
      "subnet": "10.0.1.0/24",
      "hostname": "web-01.prod",
      "status": "assigned"
    }
  ]
}

Download all subnets as CSV (columns: network, name, description, folder, vlan, vrf, location, gateway, dns_primary, dns_secondary, is_pool, scan_enabled, tracked). Folder/VLAN/VRF/location are exported as human-readable names. folder_id optionally limits the export to one folder.

Download addresses as CSV (columns: ip, subnet, hostname, mac_address, description, status, owner, ptr_record). subnet_id optionally limits the export to one subnet; omit it to export all addresses.

Search by IP address, hostname, network CIDR, name, or description. Returns matching subnets and addresses, up to 50 of each.

• q — search query (required, max 500 characters)

{
  "subnets": [
    {
      "id": "c5d6e7f8-a9b0-1234-cdef-012345678901",
      "network": "10.0.1.0/24",
      "name": "Web servers"
    }
  ],
  "addresses": [
    {
      "id": "0a1b2c3d-4e5f-6789-0abc-def123456789",
      "ip": "10.0.1.10",
      "hostname": "web-01.prod"
    }
  ]
}

Returns a paginated list of activity entries.

• limit — entries to return (default 50, max 500)
• offset — pagination offset
• action, resource_type, user_id, since, until — optional filters

{
  "entries": [
    {
      "id": 1042,
      "user_id": "7f3e9a12-4b6c-4d2e-9f01-8a5b3c7d1e42",
      "action": "create",
      "resource_type": "subnet",
      "resource_id": "c5d6e7f8-a9b0-1234-cdef-012345678901",
      "changes": { "network": "10.0.1.0/24" },
      "created_at": "2026-03-14T10:30:00Z"
    }
  ],
  "total": 137,
  "users": { "7f3e9a12-...": "john@example.com" }
}

Returns the distinct actions and resource_types present in your activity log, for building filter UIs.

Download the activity log as CSV (up to 10,000 rows). Accepts the same filter parameters as the list endpoint.

Resolve a domain against 3 independent resolvers: Cloudflare (1.1.1.1), Google (8.8.8.8), and Quad9 (9.9.9.9).

• domain — domain name to resolve (required)
• type — record type, e.g. A, AAAA, MX, TXT, NS, CNAME, SOA (default: A)
• all=true — query all common record types at once
• authoritative=true — query the domain's own nameservers instead

{
  "domain": "example.com",
  "type": "A",
  "results": [
    {
      "resolver": "1.1.1.1:53",
      "records": ["93.184.216.34"],
      "ttl": 300,
      "response_time_ms": 2.3
    },
    { "resolver": "8.8.8.8:53", "records": ["93.184.216.34"], "ttl": 300, "response_time_ms": 5.4 },
    { "resolver": "9.9.9.9:53", "records": ["93.184.216.34"], "ttl": 37, "response_time_ms": 0.7 }
  ]
}

Check how a DNS record has propagated across 8 resolvers around the world (Cloudflare, Google, Quad9, OpenDNS, Yandex, KT, Neustar, 114DNS). Each result includes the resolver's label and location in addition to the fields returned by DNS Lookup.

Perform a reverse DNS (PTR) lookup for an IP address, with forward-confirmation (FCrDNS) of each returned name.

{
  "ip": "8.8.8.8",
  "arpa_query": "8.8.8.8.in-addr.arpa.",
  "names": [
    { "name": "dns.google", "fcrdns_valid": true }
  ],
  "authoritative_ns": "ns1.google.com"
}

Perform a WHOIS lookup for a domain or IP address. Returns the raw WHOIS text plus a parsed summary: for domains, registrar, created, expires, expires_in_days, updated, nameservers, status; for IPs, cidr, net_name, organization, abuse_contact.

{
  "query": "example.com",
  "raw": "Domain Name: EXAMPLE.COM\n...",
  "parsed": {
    "registrar": "IANA",
    "created": "1995-08-14T04:00:00Z",
    "expires": "2026-08-13T04:00:00Z",
    "expires_in_days": 40,
    "nameservers": ["a.iana-servers.net", "b.iana-servers.net"]
  }
}

Inspect a host's TLS certificate chain: each certificate's subject, issuer, sans, validity window, and days_remaining, plus chain_valid, tls_version, and cipher_suite.

{
  "host": "example.com",
  "tls_version": "TLS 1.3",
  "cipher_suite": "TLS_AES_128_GCM_SHA256",
  "chain_valid": true,
  "certificates": [
    {
      "subject": "example.com",
      "issuer": "DigiCert TLS RSA SHA256 2020 CA1",
      "sans": ["example.com", "*.example.com"],
      "not_after": "2026-08-29T21:41:26Z",
      "days_remaining": 57,
      "is_expired": false
    }
  ]
}

Fetch and validate a domain's SPF record: parsed mechanisms, dns_lookup_count against the 10-lookup limit, plus valid, warnings, and errors.

{
  "domain": "example.com",
  "found": true,
  "valid": true,
  "raw": "v=spf1 include:_spf.example.com ~all",
  "mechanisms": [
    { "qualifier": "+", "mechanism": "include", "value": "_spf.example.com" }
  ],
  "dns_lookup_count": 1,
  "dns_lookup_limit": 10,
  "warnings": ["Using ~all (softfail) instead of -all (hardfail)"]
}

Fetch and validate a domain's DMARC record: policy, subdomain_policy, parsed tags, plus valid, warnings, and errors.

{
  "domain": "example.com",
  "found": true,
  "valid": true,
  "policy": "reject",
  "raw": "v=DMARC1; p=reject; rua=mailto:...",
  "tags": { "v": "DMARC1", "p": "reject" }
}

Check an IP against 7 DNS blocklists (Spamhaus ZEN, Barracuda, SpamCop, Mailspike, UCEPROTECT L1, PSBL, SpamRATS).

{
  "ip": "203.0.113.42",
  "listed_count": 0,
  "total_checked": 7,
  "results": [
    { "list": "SpamCop", "zone": "bl.spamcop.net", "listed": false }
  ]
}

Look up the ASN, announcing prefix, and registry data for an IP address or AS number.

{
  "query": "8.8.8.8",
  "type": "ip",
  "asn": "15169",
  "as_name": "GOOGLE - Google LLC, US",
  "prefix": "8.8.8.0/24",
  "country": "US",
  "rir": "arin",
  "allocated": "2023-12-28"
}

Check which HTTP protocol versions a host supports.

{
  "host": "example.com",
  "http11": true,
  "http2": true,
  "http3_advertised": false,
  "alpn_negotiated": "h2",
  "tls_version": "TLS 1.3"
}

TCP connectivity check to a host. Probes ports 80 and 443 by default; pass ?port= to check a specific port. Rate-limited to 3 requests per minute.

{
  "host": "example.com",
  "ip": "93.184.216.34",
  "results": [
    { "port": 80, "open": true, "latency_ms": 1.3 },
    { "port": 443, "open": true, "latency_ms": 1.0 }
  ],
  "checked_at": "2026-03-21T16:30:00Z"
}

Scan 19 common ports on a host (FTP, SSH, HTTP, HTTPS, DNS, SMTP, databases, RDP, etc.), or pass ?ports= with a comma-separated list (max 25). Rate-limited to 3 requests per minute.

{
  "host": "example.com",
  "open_count": 2,
  "total": 19,
  "results": [
    { "port": 80, "service": "HTTP", "category": "Web", "open": true, "latency_ms": 2.0 },
    { "port": 443, "service": "HTTPS", "category": "Web", "open": true, "latency_ms": 1.7 },
    { "port": 22, "service": "SSH", "category": "Remote Access", "open": false }
  ]
}

Trace the network path to a host with 3 round-trip measurements per hop. Unresponsive hops have null values. Rate-limited to 3 requests per minute.

{
  "host": "example.com",
  "ip": "93.184.216.34",
  "hops": [
    { "hop": 1, "ip": "172.31.1.1", "rtt1_ms": 2.3, "rtt2_ms": 2.7, "rtt3_ms": 2.8 },
    { "hop": 2, "ip": null, "rtt1_ms": null, "rtt2_ms": null, "rtt3_ms": null }
  ]
}

Returns the client's public IP address, plus country, datacenter (edge location), and hostname (reverse DNS) when available.

{
  "ip": "203.0.113.42",
  "country": "US",
  "datacenter": "DEN"
}

Returns the HTTP headers sent by the client. Pass ?url=https://... to instead fetch a remote site and get back its response headers with a security_checklist (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy).

{
  "headers": {
    "User-Agent": "curl/8.1.0",
    "Accept": "*/*"
  },
  "method": "GET",
  "proto": "HTTP/1.1"
}