Synthient API Lookup API
Single-IP, batch-IP, and domain enrichment endpoints.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/synthient:synthient-lookup-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Synthient Lookup API
version: 1.0.0
description: Synthient API for IP enrichment, account management, and real-time data feeds.
servers:
- url: /api/v4
description: Versioned HTTP API base path
tags:
- name: Lookup
description: Single-IP, batch-IP, and domain enrichment endpoints.
paths:
/lookup/domain/{domain}:
get:
operationId: domainLookup
summary: Look up honeypot intelligence for a domain
description: 'Return honeypot intelligence for a domain: aggregate stats, a daily time series, unique-IP block, top ASN/subdomains/ports, geo distribution, an hour×day-of-week activity heatmap, derived activity stats, and the most recent events.'
tags:
- Lookup
security:
- apiKeyAuth: []
parameters:
- name: domain
in: path
required: true
schema:
type: string
example: google.com
description: Domain name to look up. Encode internationalised names as Punycode (xn--…).
- name: limit
in: query
schema:
type: integer
minimum: 1
maximum: 1000
default: 50
description: Maximum number of recent_events rows to return. Defaults to 50; values above 1000 are clamped server-side.
responses:
'200':
description: Domain intelligence result
content:
application/json:
schema:
$ref: '#/components/schemas/DomainLookupResponse'
'401':
description: Unauthorized
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
'402':
description: Payment Required - Quota exhausted
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
'422':
description: Validation error (bad domain syntax, too long)
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ValidationProblemDetails'
'429':
description: Rate limit exceeded
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
'500':
description: Internal server error
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
'503':
description: Service unavailable (lookup deadline exceeded or backend offline)
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
/lookup/ip/{ip_address}:
get:
operationId: ipLookup
summary: Look up providers for an IP address
description: Return the proxy, VPN, and anonymizer providers associated with a single IP address.
tags:
- Lookup
security:
- apiKeyAuth: []
parameters:
- name: ip_address
in: path
required: true
schema:
type: string
example: 8.8.8.8
description: IPv4 or IPv6 address to look up
responses:
'200':
description: IP providers result
content:
application/json:
schema:
$ref: '#/components/schemas/IpProvidersResponse'
'401':
description: Unauthorized
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
'422':
description: Validation error
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ValidationProblemDetails'
'500':
description: Internal server error
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
/lookup/ips:
post:
operationId: lookupIpBatch
summary: Enrich multiple IP addresses
description: Enrich up to 1,000 IP addresses in a single request. Billed at a 10% discount (ceil(n × 0.9) credits); duplicates and invalid IPs are excluded before charging.
tags:
- Lookup
security:
- apiKeyAuth: []
requestBody:
description: Batch IP lookup request
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/IpBatchRequest'
responses:
'200':
description: Successful batch lookup
content:
application/json:
schema:
$ref: '#/components/schemas/IpBatchResponse'
'401':
description: Unauthorized
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
'402':
description: Payment Required - Quota exhausted
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
'422':
description: Validation Error
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ValidationProblemDetails'
'500':
description: Internal Server Error
content:
application/problem+json:
schema:
$ref: '#/components/schemas/ProblemDetails'
components:
schemas:
IpBatchResponse:
type: object
properties:
results:
type: array
items:
$ref: '#/components/schemas/IpProvidersResponse'
required:
- results
IntelligenceInfo:
type: object
properties:
behavior:
type: array
items:
type: string
categories:
type: array
items:
type: string
devices:
type: array
items:
$ref: '#/components/schemas/DeviceInfo'
providers:
type: array
items:
$ref: '#/components/schemas/ProviderEntry'
risk_score:
type: integer
required:
- risk_score
- devices
- behavior
- categories
- providers
ProviderEntry:
type: object
properties:
last_seen:
type: integer
format: int64
provider:
type: string
type:
type: string
required:
- provider
- type
- last_seen
LocationInfo:
type: object
properties:
city:
type: string
country:
type: string
geo_hash:
type: string
latitude:
type: number
longitude:
type: number
state:
type: string
timezone:
type: string
required:
- country
- state
- city
- timezone
- longitude
- latitude
- geo_hash
ValidationProblemDetails:
type: object
properties:
errors:
type: object
additionalProperties:
type: array
items:
type: string
instance:
type: string
status:
type: integer
title:
type: string
type:
type: string
required:
- type
- title
- status
- errors
TimeSeriesEntry:
type: object
properties:
date:
type: integer
format: int64
events:
type: integer
format: int64
unique_ips:
type: integer
format: int64
required:
- date
- events
- unique_ips
IpBatchRequest:
type: object
properties:
ips:
type: array
items:
type: string
required:
- ips
PortEntry:
type: object
properties:
count:
type: integer
format: int64
port:
type: integer
required:
- port
- count
UniqueIPsBlock:
type: object
properties:
sparkline_24h:
type: array
items:
type: integer
format: int64
value_24h:
type: integer
format: int64
value_30d:
type: integer
format: int64
required:
- value_24h
- value_30d
- sparkline_24h
ProblemDetails:
type: object
properties:
detail:
type: string
instance:
type: string
status:
type: integer
title:
type: string
type:
type: string
required:
- type
- title
- status
- detail
NetworkInfo:
type: object
properties:
abuse_email:
type: string
abuse_phone:
type: string
asn:
type: integer
domain:
type: string
isp:
type: string
org:
type: string
type:
type: string
required:
- asn
- isp
- type
ASNEntry:
type: object
properties:
asn:
type: integer
events:
type: integer
format: int64
required:
- asn
- events
Stats:
type: object
properties:
events_24h:
type: integer
format: int64
total_events_30d:
type: integer
format: int64
required:
- total_events_30d
- events_24h
IpProvidersResponse:
type: object
properties:
intelligence:
$ref: '#/components/schemas/IntelligenceInfo'
ip:
type: string
location:
$ref: '#/components/schemas/LocationInfo'
network:
$ref: '#/components/schemas/NetworkInfo'
required:
- ip
DeviceInfo:
type: object
properties:
last_seen:
type: integer
format: int64
os:
type: string
version:
type: string
required:
- os
- version
- last_seen
DomainLookupResponse:
type: object
properties:
activity_stats:
$ref: '#/components/schemas/ActivityStatsBlock'
domain:
type: string
geo_distribution:
type: array
items:
$ref: '#/components/schemas/CountryEntry'
hour_dow_heatmap:
type: array
items:
type: array
items:
type: integer
format: int64
recent_events:
type: array
items:
$ref: '#/components/schemas/RecentEvent'
stats:
$ref: '#/components/schemas/Stats'
status:
type: string
time_series:
type: array
items:
$ref: '#/components/schemas/TimeSeriesEntry'
top_asn:
$ref: '#/components/schemas/ASNEntry'
top_ports:
type: array
items:
$ref: '#/components/schemas/PortEntry'
top_subdomains:
type: array
items:
$ref: '#/components/schemas/SubdomainEntry'
unique_ips:
$ref: '#/components/schemas/UniqueIPsBlock'
required:
- domain
- status
- stats
- time_series
- unique_ips
- top_subdomains
- top_ports
- geo_distribution
- hour_dow_heatmap
- activity_stats
- recent_events
SubdomainEntry:
type: object
properties:
count:
type: integer
format: int64
subdomain:
type: string
required:
- subdomain
- count
RecentEvent:
type: object
properties:
country_code:
type: string
port:
type: integer
source_ip_masked:
type: string
target_subdomain:
type: string
timestamp:
type: integer
format: int64
required:
- timestamp
- source_ip_masked
- target_subdomain
- port
- country_code
ActivityStatsBlock:
type: object
properties:
cadence:
type: string
median_per_hour:
type: integer
format: int64
p95_per_hour:
type: integer
format: int64
peak_hour:
type: integer
quiet_hour:
type: integer
required:
- peak_hour
- quiet_hour
- median_per_hour
- p95_per_hour
- cadence
CountryEntry:
type: object
properties:
country_code:
type: string
events:
type: integer
format: int64
unique_ips:
type: integer
format: int64
required:
- country_code
- unique_ips
- events
securitySchemes:
apiKeyAuth:
type: apiKey
in: header
name: X-Api-Key
description: Private API key passed in the X-Api-Key header.
x-provenance:
method: harvested
publisher: Synthient API
source: https://api.synthient.com/openapi.json
note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
stamped by stamp-openapi-provenance.py (roadmap#793)