Skip to content
POST AI agent ready /v1/ip/intelligence

IP Intelligence API - Rich IP Profiling with Geo, Network & TLS Data

Returns a comprehensive profile for the caller's IP address, including geolocation (country, city, region, coordinates, EU membership), network data (ASN, organization, reverse DNS), security indicators (VPN detection with confidence signals), TLS connection details (version, cipher, protocol), and Cloudflare connection metadata.

Code examples

curl -X POST https://api.botoi.com/v1/ip/intelligence \
  -H "Content-Type: application/json" \
  -d '{}'

When to use this API

Zero-trust access logging

Log the full IP profile on every authentication event. Capture geo, ASN, TLS version, and VPN status to build a behavioral baseline for each user. Flag logins that deviate from the established pattern.

Bot detection enrichment

Combine TLS fingerprint data and VPN indicators with your existing bot detection pipeline. Legitimate browsers and headless scrapers produce different TLS cipher suites and protocol versions.

Connection fingerprinting

Use the TLS version, cipher, HTTP protocol, and TCP round-trip time to build a connection fingerprint. Track fingerprint consistency across sessions for fraud detection without relying on cookies.

Frequently asked questions

Can I pass a specific IP address to profile?
No. This endpoint profiles the caller's own connection. The IP, TLS, and connection data come directly from the Cloudflare edge handling your request. For looking up arbitrary IPs, use the /v1/ip/lookup endpoint.
How reliable is the VPN detection?
VPN detection uses heuristics like known VPN ASN ranges and datacenter IP blocks. It catches major VPN providers but cannot detect all VPN connections. The vpn_indicators array explains which signals triggered the flag.
What TLS data is available?
The TLS section includes the negotiated TLS version (TLSv1.2 or TLSv1.3), the cipher suite, and the HTTP protocol (h2, h3, or http/1.1). This data comes from Cloudflare's edge and reflects the actual connection parameters.
Does this endpoint count against my rate limit?
Yes. It counts as one API call like any other endpoint. Anonymous users are subject to the standard 5 req/min burst and 100 req/day limit.
Is the geolocation data the same as /v1/ip/lookup?
The geo fields are identical in format. The difference is that /v1/ip/intelligence adds network, security, TLS, and connection sections that /v1/ip/lookup does not include.

Get your API key

Free tier includes 5 requests per minute with no credit card required. Upgrade for higher limits.

Sign up free View full docs