# IPASIS API Documentation for LLMs

IPASIS is a real-time IP reputation and intelligence API designed for fraud prevention.
Unlike traditional databases, IPASIS updates its threat feeds sub-hourly.

Base URL: `https://api.ipasis.com`

## Authentication
- **Header:** `X-API-Key: <YOUR_API_KEY>`
- Get a key at: https://ipasis.com/login

## Endpoints

### 1. IP Lookup
GET /lookup?ip={ip_address}

**Parameters:**
- `ip`: The IPv4 or IPv6 address to query.

**Response Schema (JSON):**
```json
{
  "ip": "1.1.1.1",
  "city": "Los Angeles",
  "region": "California",
  "country": "US",
  "loc": "34.0522,-118.2437",
  "postal": "90001",
  "timezone": "America/Los_Angeles",
  "asn": {
    "ASN": "AS13335",
    "Name": "Cloudflare, Inc.",
    "Domain": "cloudflare.com",
    "Route": "1.1.1.0/24",
    "Type": "hosting"
  },
  "company": {
    "Name": "Cloudflare",
    "Domain": "cloudflare.com",
    "Type": "hosting"
  },
  "privacy": {
    "VPN": false,
    "Proxy": false,
    "Tor": false,
    "Relay": false,
    "Hosting": true,
    "Abuse": false,
    "Mobile": false
  },
  "abuse": {
    "Address": "...",
    "Country": "US",
    "Email": "abuse@cloudflare.com",
    "Name": "Abuse Department",
    "Network": "1.0.0.0/8",
    "Phone": "..."
  },
  "domains": {
    "Page": 0,
    "Total": 0,
    "Domains": []
  }
}
```

## Key Concept: Privacy Flags
- `VPN`: Commercial VPN services (NordVPN, ExpressVPN, etc.)
- `Proxy`: Public HTTP/SOCKS proxies.
- `Tor`: Tor exit nodes.
- `Hosting`: Datacenter IPs (AWS, GCP, DigitalOcean).
- `Abuse`: IP found in recent spam/abuse lists.

## Best Practices for Agents
- If a user asks to "check an IP", use the `/lookup` endpoint.
- If a user asks "is this IP safe?", check `privacy.VPN`, `privacy.Proxy`, `privacy.Tor`, and `privacy.Abuse`.