Response Fields

The Ipregistry API returns more than 50 unique data points. Here are the field names used in response payloads and their description:

JSON payloads always include all fields by default. In the case it was not possible to determine a correct value, the special value null is set as a field value.

You can see all fields with real values by opening the following URL in your browser:
https://api.ipregistry.co/?key=tryout&pretty=true

FieldDescription
ipThe IP address that was looked up.
typeThe IP address type: IPv4 or IPv6.
carrier → nameThe name of the carrier that owns the IP Address. If it is non null it means that our data analysis has shown with a very high likelihood that the IP address is exclusively used for mobile carrier traffic.
carrier → mccThe Mobile Country Code (MCC) of the carrier, when available.
carrier → mncThe Mobile Network Code (MNC) of the carrier, when available.
connection → asnThe Autonomous System Number associated with the IP.
connection → domainThe top level domain name associated with the organization that owns the connection IP.
connection → organizationThe name of the organization that owns the IP Address. This will default to the ISP if the name of the organization is not available.
connection → typeClassifies the connection type among business, education, hosting and isp.
currency → codeThe ISO 4217 3-letter currency code.
currency → nameThe name of the currency in US locale.
currency → name_nativeThe name of the currency in native locale based on detected location and primary language.
currency → pluralThe plural name of the given currency in US locale.
currency → plural_nativeThe plural name of the given currency in native locale based on detected location and primary language.
currency → symbolThe symbol of the given currency. For instance, A$ for Australian dollars.
currency → symbol_nativeThe native (local) symbol of the given currency. For instance, $ for Australian dollars.
currency → format → negative → prefixThe currency prefix for negative amounts. For instance, - for -10 euros.
currency → format → negative → suffixThe currency suffix for negative amounts. For instance, for -10 euros.
currency → format → positive → prefixThe currency prefix for positive amounts. For instance, $ for 10 US dollars.
currency → format → positive → suffixThe currency suffix for positive amounts. For instance, the empty string for 10 US dollars.
location → continent → codeThe 2 letter ISO 3166-1 alpha-2 code associated with the IP.
location → continent → nameThe name of the continent associated with the IP.
location → country → areaThe sum of land and water areas within international boundaries and coastlines in km².
location → country → bordersThe 2 letter ISO 3166-1 alpha-2 code of the countries that border the country associated with this IP. An empty list is returned if the country has no land borders.
location → country → calling_codeThe calling/dial code of the country associated with the IP.
location → country → capitalThe capital city of the country associated with the IP.
location → country → codeThe 2 letter ISO 3166-1 alpha-2 code associated with this IP.
location → country → nameThe name of the country where the IP address is located.
location → country → populationThe total population in number of residents for the country associated with the IP.
location → country → population_densityThe number of residents per km² for the country associated with the IP.
location → country → flag → emojiThe emoji icon for the flag of the country associated with the IP.
location → country → flag → emoji_unicodeThe unicode value of the emoji icon for the flag of the country associated with the IP.
location → country → flag → emojitwoA link to the EmojiTwo SVG file associated with the flag of the country where the IP address is located. See the license for requirements about how to use these images.
location → country → flag → notoA link to the Noto PNG file associated with the flag of the country where the IP address is located. See the license for requirements about how to use these images.
location → country → flag → twemojiA link to the Twemoji SVG file associated with the flag of the country where the IP address is located. See the license for requirements about how to use these images.
location → country → flag → wikimediaA link to the raw SVG file associated with the flag of the country where the IP address is located. The source files were taken from Wikipedia and are not under copyright protection since raw flags are in the public domain.
location → country → languagesA list of spoken languages spoken in the country associated with the IP. Entries are sorted by popularity in descending order.
location → country → languages → codeThe 2 letter 639-1 code associated with the language.
location → country → languages → nameThe name of the given language.
location → country → languages → nativeThe native name of the given language.
location → region → codeThe region code of the region associated with the IP.
location → region → nameThe name of the region associated with the IP.
location → cityThe name of the city associated with the IP.
location → postalThe ZIP code associated with the IP.
location → latitudeThe latitude value associated with the IP.
location → longitudeThe longitude value associated with the IP.
location → language → codeThe 2 letter 639-1 code of the main language associated with the IP location.
location → language → nameThe name of the main language associated with the IP location.
location → language → nativeThe native name of the main language associated with the IP location.
location → in_euBoolean indicating whether the country is a recognized member of the European Union.
security → is_bogonBoolean indicating whether the IP Address is a Bogon: an unassigned, unaddressable IP address.
security → is_cloud_providerBoolean indicating whether the IP address is used for hosting purposes (e.g. a node on Google Cloud Platform, Amazon EC2, and more).
security → is_torBoolean indicating whether the IP Address is a Tor relay: exit relay node, middle relay node or a bridge.
security → is_tor_exitBoolean indicating whether the IP Address is a Tor exit relay node.
security → is_proxyBoolean indicating whether the IP Address is a known proxy. It includes HTTP/HTTPS/SSL/SOCKS/CONNECT and transparent proxies.
security → is_anonymousBoolean with true value if is_proxy OR is_tor is satisfied.
security → is_abuserBoolean indicating whether the IP Address is a known source of abuse (e.g. spam, harvesters, registration bots).
security → is_attackerBoolean indicating whether the IP Address is a known source of malicious activity (e.g. attacks, malware, botnet activity).
security → is_threatBoolean with true value if is_abuser, is_attacker OR is_cloud_provider is satisfied.
time_zone → idThe tz database ID of the time zone associated with the IP.
time_zone → abbreviationThe abbreviation of the time zone associated with the IP.
time_zone → current_timeThe current date and time using ISO 8601 format for the location associated with the IP.
time_zone → nameThe name of the time zone associated with the IP.
time_zone → offsetThe GMT offset of the given time zone in seconds.
time_zone → in_daylight_savingBoolean indicating whether or not the given time zone is considered in daylight saving time.

User-Agent fields

Fields return with the user-agent lookup endpoint or the origin IP lookup endpoint:

FieldDescription
user_agent → headerThe raw User-Agent string that is extract from the user request.
user_agent → nameThe name of the actual "Browser" that was used.
user_agent → typeThe type of the actual "Browser" that was used. Here is a list of possible values:
  • browser: a regular browser.
  • browser-webview: a regular browser being used as part of a mobile app.
  • cloud-application: something running in a cloud (but not a regular robot).
  • email-client: an email application.
  • hacker: a hacker, so it can really be anything.
  • mobile-app: a mobile app.
  • null: we don't know.
  • robot: a robot that wants to be treated as a desktop device.
  • robot-mobile: a robot that wants to be treated as a mobile device.
  • special: something special we cannot fully classify.
  • testclient: a website testing tool.
  • voice: a voice driven "Browser" (i.e. ask a question and the page is read aloud).
user_agent → versionThe version of the actual "Browser" that was used.
user_agent → version_majorThe version major of the actual "Browser" that was used.
user_agent → device → brandThe brand of the hardware that was used.
user_agent → device → nameThe name of the hardware that was used.
user_agent → device → typeThe type of the hardware that was used. Here is a list of possible values:
  • anonymized: in case the User-Agent has been altered by an anonymization software.
  • desktop: the device is assessed as a Desktop/Laptop class device.
  • ereader: similar to a tablet yet in most cases with an e-ink screen.
  • game-console: "fixed" game systems like the PlayStation and Xbox.
  • hacker: in case scripting is detected in the User-Agent string, also fallback in really broken situations.
  • handheld-game-console: "mobile" game systems like the 3DS.
  • mobile: a device that is mobile yet we do not know if it is a ereader/tablet/phone or watch.
  • null: we really don't know, these are usually User-Agents that look normal yet contain almost no information about the device.
  • phone: a mobile device with a small screen (usually lower than 7").
  • robot: a robot that visits the site.
  • robot-imitator: a robot that visit the site pretending it is a robot like Google, but they are not.
  • robot-mobile: a robot that visits the site and want to be seen as a mobile visitor.
  • set-top-box: a connected device that allows interacting via a TV sized screen.
  • tablet: a mobile device with a rather large screen (usually greater than 7").
  • tv: similar to set-top box yet here this is built into the TV.
  • virtual-reality: a mobile device with a VR capabilities.
  • voice: a voice driven device (i.e. ask a question and the page is read aloud).
  • watch: a mobile device with a tiny screen (usually lower than 2").
user_agent → engine → nameThe name of the underlying core that converts the 'HTML' into a visual/interactive.
user_agent → engine → typeThe type of the underlying core that converts the 'HTML' into a visual/interactive. Here is a list of possible values:
  • browser: a regular browser.
  • mobile-app: a mobile app which probably includes a regular Web browser.
  • hacker: a hacker, so it can really be anything (e.g. script injections).
  • robot: a robot spidering the site.
  • null: we don't know.
user_agent → engine → versionThe version of the underlying core that converts the 'HTML' into a visual/interactive.
user_agent → os → nameThe name of the resulting OS.
user_agent → os → typeThe type of the resulting OS. Here is a list of possible values:
  • cloud: looks like a thing that runs in a cloud environment.
  • desktop: the type of OS you would run on a Desktop or Laptop.
  • embedded: apparently embedded into something like a TV.
  • game-console: a game console like a PlayStation or Xbox.
  • hacker: a hacker, so it can really be anything (e.g. script injection).
  • mobile: the type of OS you would run on a phone, tablet or watch.
  • null: we don't known.
user_agent → os → versionThe version of the resulting OS.

Response headers

In addition to the HTTP message body that contains the fields describe above, a response also includes specific Ipregistry headers:

NameDescription
Ipregistry-CreditsThe number of credits (lookups) remaining on your account.
Ipregistry-PodAn internal identifier to know what node has executed your request. Please share it with support for troubleshooting.
Ipregistry-VersionThe API version used by your account.