Tools API

Every free tool is a REST endpoint. They need no key and no account, they share the daily budget described under Free Tools, and they are separate from the main API: a different namespace, a different limit, and no quota to spend. Use them for a one-off check or a small script. Anything that needs volume belongs on the main API.

Base URL and request format

All endpoints live under one namespace:

https://reportedip.com/wp-json/ridns/v1

Sixteen of them take POST with a JSON body; /whoami takes GET. Set Content-Type: application/json. There is no authentication header, and no X-Key: sending one changes nothing.

Response shape

Every answer uses the same envelope, so a client can branch on one field:

{
  "success": true,
  "data": { ... }
}

And on failure:

{
  "success": false,
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Daily limit of 30 checks reached. Please try again tomorrow."
  }
}

DNS lookups

POST /check

Resolves one record type across a set of resolvers and reports what each one returned. This is the endpoint behind the DNS Checker.

curl -X POST https://reportedip.com/wp-json/ridns/v1/check \
  -H "Content-Type: application/json" \
  -d '{"domain":"example.com","record_type":"MX","preset":"fast"}'

POST /check/all

Runs every supported record type against one domain in a single request. Takes domain and nothing else.

Address checks

POST /dnsbl/check

Queries the curated blacklist set for one address, IPv4 or IPv6, and returns which lists answer and with what return code. Behind DNSBL Blacklist Check.

Three of the twelve lists publish no IPv6 zone. For an IPv6 address they are reported as not applicable rather than as a clean result, so an empty answer is never mistaken for a pass. The method is described under Verification Methods.

POST /reverse-dns/check

Resolves the PTR record of an address and checks whether the name resolves back to it. Takes one parameter, query, which accepts an IPv4 address, an IPv6 address or a hostname. For a hostname every A and AAAA record is checked in turn.

curl -X POST https://reportedip.com/wp-json/ridns/v1/reverse-dns/check \
  -H "Content-Type: application/json" \
  -d '{"query":"8.8.8.8"}'

POST /bot/verify

Decides whether an address really belongs to the crawler it claims to be.

The verdict is one of confirmed, unconfirmed or unattributable. Which of the two verification methods applies depends on the operator and is stated in the response.

POST /abuse/lookup

Finds the mailbox responsible for an address over RDAP. Takes query: an IP address or a domain, which is resolved first. The answer names the registry, the network block, its holder, the country and the abuse address, and adds the community reputation of the address.

POST /asn/lookup

Reports the network behind an address. Takes query: an IP address or an AS number with or without the AS prefix. Aggregate only, the response never lists the addresses that make up a network.

curl -X POST https://reportedip.com/wp-json/ridns/v1/asn/lookup \
  -H "Content-Type: application/json" \
  -d '{"query":"AS14061"}'

Email security

POST /security/validate

Runs all seven email checks at once and returns a combined score.

Only the checks actually requested count towards the score. Deselecting one removes it from the calculation instead of scoring it zero, which is why a three-check run can still reach 100. The weights are listed under Tool Scoring.

The seven single checks

Each check is also available on its own. All of them take domain; /security/dkim additionally accepts selectors, an array of up to 20 selector names to try instead of the built-in list.

HTTP and request inspection

POST /headers/check

Fetches one page and reads its security headers. Takes url, a domain or a full URL. The request is made with GET rather than HEAD, because a number of servers answer HEAD with a different header set.

The fetch is restricted: only http and https, only ports 80 and 443, every resolved address is checked against the private, loopback, link-local, CGNAT and multicast ranges in both address families, redirects are followed manually and at most three times with the same check applied each time, and only the first few kilobytes of the body are read. An address that fails any of those returns an error instead of a result.

GET /whoami

Returns what the request itself reveals: the client address, its reverse DNS, the network and location derived from it, and the community reputation of that address. The only GET endpoint, and the only one whose answer depends on who is asking.

curl https://reportedip.com/wp-json/ridns/v1/whoami

Limits in practice

• A check counts when it runs, not when it succeeds. A malformed request that reaches the validator still costs one.
• Identical queries are answered from a 90-second cache and cost nothing inside that window.
• The budget is shared across all endpoints in this namespace: 30 requests a day without an account, 100 when signed in.
• There is no burst limit and no per-minute cap. The daily counter is the only limit.

For sustained use, an API key on the main API starts at 1,000 checks a day and returns the same reputation data.

Last updated: 20. September 2026 · Maintained by the ReportedIP team