API

IP geolocation API with ASN, reverse DNS and bulk lookup

Country, city and network owner for one IP or a hundred, from an offline database.

What it does

The IP Geolocation API turns an IP address into a place and a network. You get country, region and city, the ASN and network, and whether the address is public or private. You can also ask for reverse DNS and reputation-feed hits in the same call.
It solves the "where is this traffic from?" question without sending every visitor address to an outside service. The data is an offline DB-IP corpus held by Takelan and refreshed on a schedule.
IP location is an estimate. It tells you roughly where a network is, not where a person is.
Affordable by design. Start free* within platform limits for connected ShadowCradle organizations, with affordable pricing beyond that. *Free within platform limits; usage beyond limits may be charged to maintain the platform.

See how it works

An IP address becomes a place, offline

Lookups are answered from an offline DB-IP corpus that Takelan holds and refreshes on a schedule, so visitor addresses are not sent to an outside service. The location is an estimate of the network, not of a person.

Example use cases

Triage a suspicious login

Security teams look up the source IP, add reverse DNS and feed hits with include_reputation, and decide in one call.

Enrich logs in bulk

Ops teams post up to 100 addresses at once. A bad address comes back as its own failed row and does not break the batch.

Region-aware product behavior

Product teams use /me to default currency, language or data region for the caller.

MSP client reports

An MSP summarizes firewall logs by country and ASN to show a client where scans and attacks come from.

Check who owns a network

Use the ASN data to see which provider announces an address before opening a ticket with them.

Try it

Look up one address

curl -s "https://app.takelan.com/api/v1/ip/lookup/203.0.113.7" \
  -H "X-API-Key: $TAKELAN_API_KEY"

Response (trimmed, fictional): { "ip": "203.0.113.7", "ip_version": 4, "is_public": true, "scope": "public", "found": true, "location": { "country_code": "XX", "country_name": "Exampleland", "city": "Sample City", "accuracy": "city" }, "asn": { "asn": 64500, "organization": "Example Net" }, "cached": false }

Bulk lookup with reputation

curl -s -X POST "https://app.takelan.com/api/v1/ip/bulk" \
  -H "X-API-Key: $TAKELAN_API_KEY" -H "Content-Type: application/json" \
  -d '{"ips":["203.0.113.7","198.51.100.9"],"include_reputation":true}'

Up to 100 addresses per call. include_asn is on by default; include_nearby, include_reputation and include_reverse_dns are off by default.

Endpoints

POST /api/v1/ip/lookup Lookup: one address in a JSON body.
GET /api/v1/ip/lookup/{ip_address} Lookup: one address in the path.
GET /api/v1/ip/me Lookup: the caller's own address.
POST /api/v1/ip/bulk Lookup: up to 100 addresses; per-row errors.
GET /api/v1/ip/{ip}/reputation Enrich: reputation-feed hits for the address.
GET /api/v1/ip/{ip}/reverse Enrich: reverse DNS (PTR) answer.
GET /api/v1/ip/stats Corpus: size and coverage.
GET /api/v1/ip/usage Corpus: your recent lookups.
GET /api/v1/ip/datasets Corpus: dataset status (city and ASN). Refresh and update calls are admin operations.

MCP

Available as tools through /mcp/utils. Read tools work by default with an API key. Anything that writes is off until your tenant turns on the writes switch, and a read-only key never writes. Calls run with your own permissions. About MCP

Common questions

Is there an IP geolocation API that does not call a third party each time?

Yes. Lookups run against an offline DB-IP corpus held by Takelan, refreshed on a schedule.

How do I look up many IP addresses at once?

POST up to 100 to /api/v1/ip/bulk. Invalid entries return their own error row and the rest still resolve.

Can I get the ASN for an IP address by API?

Yes. ASN and network details are included by default on lookup and bulk calls.

Can I get reverse DNS with the location?

Yes. Set include_reverse_dns, or call /api/v1/ip/{ip}/reverse. A resolver failure is reported inside the answer, not as a missing field.

How accurate is IP geolocation?

It is an estimate. The response carries an accuracy level (city, region or country) and a radius. Treat it as a hint, not proof of where a user is.

What happens with private or reserved IPs?

They return with is_public false and a scope such as private or loopback, instead of a location.

How do I authenticate?

Send X-API-Key, or a bearer token. Service clients can use the ip.read scope.

Can my AI agent use it?

Yes, as read tools through /mcp/utils. Writes are off by default.

All API families | Takelan Utilities & APIs | Pricing