# IP lookups by path, for the caller, in batches, in bulk and from the browser

GET and self lookups, privacy mode, batch and bulk runs, a browser endpoint for publishable keys, a dashboard page, richer country facts, and a 50-per-second rate limit for IP endpoints.

Date: 2026-09-04

- `GET /api/v1/ip/{ip}` runs the same lookup as `POST /api/v1/ip` with the address in the path, and `GET /api/v1/ip/me` answers for the address the call came from.
- Privacy mode: `privacy: true` in the body or `?privacy=1` on a GET keeps nothing about the lookup, not even the seven-day repeat marker; every such call is billed as fresh. Nothing about an IP lookup was ever logged or written to history; the security page now says so.
- `POST /api/v1/ip/batch` looks up as many as 1,000 addresses in one call, in input order, with the paid partial results returned if the balance runs out mid-list.
- Bulk runs: `POST /api/v1/ip/bulk` queues up to 100,000 addresses, with polling, cancellation, a CSV of every response field per row, an `Idempotency-Key` header and a signed `bulk_ip_job.finished` webhook, exactly like bulk email runs.
- `POST /api/v1/ip/public` looks an address up from the browser with a domain-locked publishable key; leave `ip` out for the visitor's own address. Daily credit caps and Cloudflare Turnstile apply as they do for the email widget.
- New fields on every IP answer: `network` (the prefix the location covers), `continent`, `country_name`, `is_eu`, `timezone` (only when the country or a single-zone region settles it), `currency`, `calling_code`, `is_anonymous`, and `risk_signals`, which lists every contributing signal with the weight applied.
- IP endpoints have their own rate limit of 50 requests per second per key. The email endpoints keep 5.
- The dashboard gained an IP intelligence page for single lookups, batches and bulk runs, and the docs gained an IP intelligence guide with three companion guides.
- Three more signals from free data: `is_unallocated` (no regional registry has allocated or assigned the space, from the five RIRs' daily statistics; it scores 100), `is_anycast` (published CDN edge and public resolver ranges), and `is_tor` for IPv6 from the Tor Project's Onionoo relay data. `abuse_contact: true` adds the network's abuse mailbox from its RDAP record, looked up only on request.

Reference: https://spaw.co/changelog/2026-09-04-ip-api-round-two