API documentation

A single REST endpoint returns everything you need to score an address. Create a key in the dashboard to get started.

Authentication

Pass your API key as the key query parameter or in the X-API-Key header. Keys are shown once at creation time — store them securely.

Single lookup

GET /api/public/v2/<ip>

curl "https://guarda.net/api/public/v2/8.8.8.8?key=YOUR_API_KEY"

{
  "ip": "8.8.8.8",
  "status": "ok",
  "ip_version": 4,
  "is_proxy": false,
  "proxy_type": null,
  "proxy_types": [],
  "tor": false,
  "vpn": false,
  "public_proxy": false,
  "web_proxy": false,
  "hosting": true,
  "residential": false,
  "cellular": false,
  "search_bot": false,
  "abuser": false,
  "risk": 34,
  "risk_level": "medium",
  "risk_reasons": ["Datacenter / hosting network"],
  "confidence": 92,
  "country": "United States",
  "country_code": "US",
  "region": "California",
  "state_code": "CA",
  "city": "Mountain View",
  "postal_code": "94035",
  "latitude": 37.386,
  "longitude": -122.0838,
  "timezone": "America/Los_Angeles",
  "currency": "USD",
  "asn": "AS15169",
  "provider": "Google LLC",
  "isp": "Google LLC",
  "domain": "google.com",
  "hostname": "dns.google",
  "connection_type": "hosting",
  "checked_at": "2026-01-01T00:00:00.000Z"
}

Batch lookup

POST /api/public/v2/batch — up to 50 addresses per request.

curl -X POST "https://guarda.net/api/public/v2/batch" \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_API_KEY" \
  -d '{"ips": ["8.8.8.8", "1.1.1.1"]}'

Response fields

Field	Description
ip	The address that was queried.
status	"ok" or "error".
is_proxy	Boolean verdict combining proxy, VPN, TOR and hosting signals.
proxy_type / proxy_types	Primary label (VPN, TOR, Hosting…) and every matching type.
tor / vpn / public_proxy / web_proxy	Individual anonymiser signals.
hosting / residential / cellular	Network classification of the address.
search_bot / abuser	Verified crawler and known-abuse flags.
risk / risk_level	Integer 0–100 plus low, medium, high or critical.
risk_reasons	Human-readable explanation of what drove the score.
confidence	Feed confidence in the classification, 0–100.
country / country_code / region / state_code	Resolved location.
city / postal_code / latitude / longitude	Fine-grained geolocation where available.
asn / provider / isp	Autonomous system number and network operator.
domain / hostname / connection_type	Reverse DNS and connection classification.
timezone / currency	Local timezone and currency code.
checked_at	UTC timestamp of the lookup.

Errors & limits

401 — missing, revoked or unknown API key.
400 — malformed IP address or request body.
429 — daily quota exhausted for the account.