Public API

MyIPScan API

Free IP, DNS, TLS and HTTP lookups. No API key, no signup, no account. Twenty-three read-only endpoints returning JSON.

Base URL: https://myipscan.net/api/
Authentication: None
Response format: JSON (UTF-8)
Rate limit: 30 requests per minute per IP
CORS: Restricted — server-side use
Cost: Free

Quick start

Every endpoint is a plain GET returning JSON, unless listed under POST below. There is nothing to sign up for and no key to send.

curl https://myipscan.net/api/ip
curl "https://myipscan.net/api/ip-geolocation-lookup?ip=8.8.8.8"
curl "https://myipscan.net/api/dns-lookup?name=example.com&type=A"

Successful responses carry "ok": true and a checkedAt timestamp. Failures carry "ok": false and an error object with a stable code, a human-readable message and, where useful, a details object.

{
  "ok": false,
  "error": {
    "code": "private_ip",
    "message": "Loopback addresses are local to a device."
  },
  "checkedAt": "2026-07-29T20:45:21.001Z"
}

Endpoints

Nineteen GET endpoints and four POST endpoints. Parameters are exact; every one below was called against the live service before publication.

Address and network

Endpoint	Parameters	Returns
`/api/ip`	`—`	Your own address as seen by the edge: IP, country, city, region, coordinates, timezone, ASN, organisation, ISP.
`/api/ip-geolocation-lookup`	`ip`	Country, region, city, coordinates and network for any public IP.
`/api/asn-lookup`	`query`	Autonomous system details. Accepts an ASN number or a public IP.
`/api/rdap`	`query`	Raw RDAP registry record for an IP or ASN, straight from the responsible RIR.
`/api/reverse-dns`	`ip`	PTR record for a public IP.
`/api/tor-exit`	`ip`	Whether the address appears on the public Tor exit-node list.
`/api/ip-blacklist-checker`	`ip`	Presence of the address on public DNS blocklists.

DNS and certificates

Endpoint	Parameters	Returns
`/api/dns-lookup`	`name, type`	DNS records over DoH. Type accepts A, AAAA, MX, NS, TXT, CNAME, SOA.
`/api/ssl-certificate`	`host`	TLS certificate summary: issuer, validity window, subject names.

HTTP surface

Endpoint	Parameters	Returns
`/api/http-headers`	`url`	Response headers plus a read of the common security headers.
`/api/http-latency`	`url`	Response timing for a single HEAD request.
`/api/redirect-checker`	`url`	Full redirect chain with status codes and timing per hop.

Crawl and markup

Endpoint	Parameters	Returns
`/api/robots-txt`	`url`	robots.txt as served, with parsed directives.
`/api/sitemap-checker`	`url`	Sitemap discovery and basic validity.
`/api/canonical-noindex`	`url`	Canonical URL and indexing directives from headers and markup.
`/api/meta-title-description`	`url`	Title and meta description with lengths.
`/api/open-graph-social`	`url`	Open Graph and Twitter card fields.
`/api/structured-data`	`url`	JSON-LD blocks found on the page, parsed.
`/api/html-heading-content-structure`	`url`	Heading outline and content structure.

POST endpoints

These take a JSON body with a target field and return a combined report. Content-Type: application/json is required.

Endpoint	Body field	Returns
`/api/website-exposure`	`target`	Combined public-surface report for a hostname.
`/api/domain-intelligence`	`target`	Domain overview: registry, DNS, hosting and mail signals.
`/api/email-exposure`	`target`	Mail-related exposure for a domain: SPF, DMARC, MX posture.
`/api/ai-search-visibility`	`target`	Whether AI crawlers are permitted, from robots.txt and headers.

curl -X POST https://myipscan.net/api/website-exposure \
  -H "Content-Type: application/json" \
  -d '{"target":"example.com"}'

Limits, and what this API will not do

Stated plainly so nobody builds on an assumption that does not hold.

Rate limit: 30 requests per minute per IP. Over that you receive HTTP 429. The limit is enforced per edge location, so treat it as a guide rather than a precise quota, and stay well under it.
CORS is restricted to myipscan.net. Browser JavaScript on another origin cannot call these endpoints. Server-side calls work normally. This is deliberate and unlikely to change.
Private address space is refused. Loopback, link-local, and RFC 1918 ranges return private_ip or blocked_ip. Redirects are re-checked at every hop, so a public host cannot forward a request into private space. Only http and https are accepted.
Best effort, not authoritative. Data comes from public registries, DNS and live HTTP responses. Registry records lag reality, geolocation is approximate, and a single check from one vantage point is not proof about a whole network. Use it for diagnostics, not for enforcement or compliance decisions.
No SLA and no guarantee of continuity. The service is free and provided as is, without warranty. Endpoints, fields and limits may change, and any of them may be withdrawn without notice.
Responses are not cached for you. Every call is live, which is why the rate limit matters.

Fair use

The API is open because it is useful. These terms exist so it can stay open.

Please do

Use it in your own apps, scripts, dashboards and research, commercial or not.
Cache responses on your side and keep request volume modest.
Send a descriptive User-Agent so problems can be traced to a contact rather than to a block.
Link back to myipscan.net if the data is shown to your users. Appreciated, not required.

Please do not

Probe, enumerate or scan hosts you do not own or have permission to test. The API is a diagnostic tool, not a scanning platform, and using it against third parties may be unlawful where you are.
Run bulk enumeration of address space, domain lists or certificate ranges.
Distribute requests across many addresses to work around the rate limit.
Resell the responses as your own API service.
Rely on it inside anything safety-critical, or where a wrong or missing answer causes harm.

Abuse handling

Request metadata may be logged for the sole purpose of detecting and stopping abuse. Requests that breach these terms may be throttled or blocked without notice, by address or by pattern. Nothing here grants a right of continued access.

Questions, a higher volume need, or a block you believe is wrong: get in touch.

Where the data comes from

IP and geolocation — edge request metadata and public geolocation data. City-level results are estimates and are often wrong for mobile and VPN addresses.
ASN, RDAP and registry fields — the responsible regional registry. Holder names change when networks are transferred.
DNS — public DNS-over-HTTPS resolvers. Answers reflect what those resolvers see, which can differ from your own resolver.
HTTP, TLS and markup — a live request made at call time from a Cloudflare edge location, following redirects up to a fixed limit.