Synthient API

Synthient API Lookup API

Single-IP, batch-IP, and domain enrichment endpoints.

GitHub OpenAPI
Business capability
Threat Detection & Response Management BC-620.30

Operations 3

GET /lookup/domain/{domain} Look up honeypot intelligence for a domain #
GET /lookup/ip/{ip_address} Look up providers for an IP address #
POST /lookup/ips Enrich multiple IP addresses #

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/synthient/refs/heads/main/openapi/synthient-lookup-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/synthient/refs/heads/main/json-schema/synthient-domain-lookup-response-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/synthient/refs/heads/main/json-schema/synthient-anonymizer-stream-entry-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/synthient/refs/heads/main/json-schema/synthient-torrent-stream-entry-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/synthient/refs/heads/main/json-schema/synthient-ja4-tstream-entry-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/synthient/refs/heads/main/json-schema/synthient-proxy-stream-entry-schema.json
📊
JSONSchema
https://raw.githubusercontent.com/api-evangelist/synthient/refs/heads/main/json-schema/synthient-honeypot-httpsstream-entry-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/synthient:synthient-lookup-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

synthient-lookup-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Synthient Lookup API
  version: 1.0.0
  description: Synthient API for IP enrichment, account management, and real-time data feeds.
servers:
- url: /api/v4
  description: Versioned HTTP API base path
tags:
- name: Lookup
  description: Single-IP, batch-IP, and domain enrichment endpoints.
paths:
  /lookup/domain/{domain}:
    get:
      operationId: domainLookup
      summary: Look up honeypot intelligence for a domain
      description: 'Return honeypot intelligence for a domain: aggregate stats, a daily time series, unique-IP block, top ASN/subdomains/ports, geo distribution, an hour×day-of-week activity heatmap, derived activity stats, and the most recent events.'
      tags:
      - Lookup
      security:
      - apiKeyAuth: []
      parameters:
      - name: domain
        in: path
        required: true
        schema:
          type: string
          example: google.com
        description: Domain name to look up. Encode internationalised names as Punycode (xn--…).
      - name: limit
        in: query
        schema:
          type: integer
          minimum: 1
          maximum: 1000
          default: 50
        description: Maximum number of recent_events rows to return. Defaults to 50; values above 1000 are clamped server-side.
      responses:
        '200':
          description: Domain intelligence result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DomainLookupResponse'
        '401':
          description: Unauthorized
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '402':
          description: Payment Required - Quota exhausted
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '422':
          description: Validation error (bad domain syntax, too long)
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
        '429':
          description: Rate limit exceeded
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '500':
          description: Internal server error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '503':
          description: Service unavailable (lookup deadline exceeded or backend offline)
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
  /lookup/ip/{ip_address}:
    get:
      operationId: ipLookup
      summary: Look up providers for an IP address
      description: Return the proxy, VPN, and anonymizer providers associated with a single IP address.
      tags:
      - Lookup
      security:
      - apiKeyAuth: []
      parameters:
      - name: ip_address
        in: path
        required: true
        schema:
          type: string
          example: 8.8.8.8
        description: IPv4 or IPv6 address to look up
      responses:
        '200':
          description: IP providers result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IpProvidersResponse'
        '401':
          description: Unauthorized
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '422':
          description: Validation error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
        '500':
          description: Internal server error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
  /lookup/ips:
    post:
      operationId: lookupIpBatch
      summary: Enrich multiple IP addresses
      description: Enrich up to 1,000 IP addresses in a single request. Billed at a 10% discount (ceil(n × 0.9) credits); duplicates and invalid IPs are excluded before charging.
      tags:
      - Lookup
      security:
      - apiKeyAuth: []
      requestBody:
        description: Batch IP lookup request
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/IpBatchRequest'
      responses:
        '200':
          description: Successful batch lookup
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IpBatchResponse'
        '401':
          description: Unauthorized
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '402':
          description: Payment Required - Quota exhausted
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
        '422':
          description: Validation Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ValidationProblemDetails'
        '500':
          description: Internal Server Error
          content:
            application/problem+json:
              schema:
                $ref: '#/components/schemas/ProblemDetails'
components:
  schemas:
    IpBatchResponse:
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/IpProvidersResponse'
      required:
      - results
    IntelligenceInfo:
      type: object
      properties:
        behavior:
          type: array
          items:
            type: string
        categories:
          type: array
          items:
            type: string
        devices:
          type: array
          items:
            $ref: '#/components/schemas/DeviceInfo'
        providers:
          type: array
          items:
            $ref: '#/components/schemas/ProviderEntry'
        risk_score:
          type: integer
      required:
      - risk_score
      - devices
      - behavior
      - categories
      - providers
    ProviderEntry:
      type: object
      properties:
        last_seen:
          type: integer
          format: int64
        provider:
          type: string
        type:
          type: string
      required:
      - provider
      - type
      - last_seen
    LocationInfo:
      type: object
      properties:
        city:
          type: string
        country:
          type: string
        geo_hash:
          type: string
        latitude:
          type: number
        longitude:
          type: number
        state:
          type: string
        timezone:
          type: string
      required:
      - country
      - state
      - city
      - timezone
      - longitude
      - latitude
      - geo_hash
    ValidationProblemDetails:
      type: object
      properties:
        errors:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
        instance:
          type: string
        status:
          type: integer
        title:
          type: string
        type:
          type: string
      required:
      - type
      - title
      - status
      - errors
    TimeSeriesEntry:
      type: object
      properties:
        date:
          type: integer
          format: int64
        events:
          type: integer
          format: int64
        unique_ips:
          type: integer
          format: int64
      required:
      - date
      - events
      - unique_ips
    IpBatchRequest:
      type: object
      properties:
        ips:
          type: array
          items:
            type: string
      required:
      - ips
    PortEntry:
      type: object
      properties:
        count:
          type: integer
          format: int64
        port:
          type: integer
      required:
      - port
      - count
    UniqueIPsBlock:
      type: object
      properties:
        sparkline_24h:
          type: array
          items:
            type: integer
            format: int64
        value_24h:
          type: integer
          format: int64
        value_30d:
          type: integer
          format: int64
      required:
      - value_24h
      - value_30d
      - sparkline_24h
    ProblemDetails:
      type: object
      properties:
        detail:
          type: string
        instance:
          type: string
        status:
          type: integer
        title:
          type: string
        type:
          type: string
      required:
      - type
      - title
      - status
      - detail
    NetworkInfo:
      type: object
      properties:
        abuse_email:
          type: string
        abuse_phone:
          type: string
        asn:
          type: integer
        domain:
          type: string
        isp:
          type: string
        org:
          type: string
        type:
          type: string
      required:
      - asn
      - isp
      - type
    ASNEntry:
      type: object
      properties:
        asn:
          type: integer
        events:
          type: integer
          format: int64
      required:
      - asn
      - events
    Stats:
      type: object
      properties:
        events_24h:
          type: integer
          format: int64
        total_events_30d:
          type: integer
          format: int64
      required:
      - total_events_30d
      - events_24h
    IpProvidersResponse:
      type: object
      properties:
        intelligence:
          $ref: '#/components/schemas/IntelligenceInfo'
        ip:
          type: string
        location:
          $ref: '#/components/schemas/LocationInfo'
        network:
          $ref: '#/components/schemas/NetworkInfo'
      required:
      - ip
    DeviceInfo:
      type: object
      properties:
        last_seen:
          type: integer
          format: int64
        os:
          type: string
        version:
          type: string
      required:
      - os
      - version
      - last_seen
    DomainLookupResponse:
      type: object
      properties:
        activity_stats:
          $ref: '#/components/schemas/ActivityStatsBlock'
        domain:
          type: string
        geo_distribution:
          type: array
          items:
            $ref: '#/components/schemas/CountryEntry'
        hour_dow_heatmap:
          type: array
          items:
            type: array
            items:
              type: integer
              format: int64
        recent_events:
          type: array
          items:
            $ref: '#/components/schemas/RecentEvent'
        stats:
          $ref: '#/components/schemas/Stats'
        status:
          type: string
        time_series:
          type: array
          items:
            $ref: '#/components/schemas/TimeSeriesEntry'
        top_asn:
          $ref: '#/components/schemas/ASNEntry'
        top_ports:
          type: array
          items:
            $ref: '#/components/schemas/PortEntry'
        top_subdomains:
          type: array
          items:
            $ref: '#/components/schemas/SubdomainEntry'
        unique_ips:
          $ref: '#/components/schemas/UniqueIPsBlock'
      required:
      - domain
      - status
      - stats
      - time_series
      - unique_ips
      - top_subdomains
      - top_ports
      - geo_distribution
      - hour_dow_heatmap
      - activity_stats
      - recent_events
    SubdomainEntry:
      type: object
      properties:
        count:
          type: integer
          format: int64
        subdomain:
          type: string
      required:
      - subdomain
      - count
    RecentEvent:
      type: object
      properties:
        country_code:
          type: string
        port:
          type: integer
        source_ip_masked:
          type: string
        target_subdomain:
          type: string
        timestamp:
          type: integer
          format: int64
      required:
      - timestamp
      - source_ip_masked
      - target_subdomain
      - port
      - country_code
    ActivityStatsBlock:
      type: object
      properties:
        cadence:
          type: string
        median_per_hour:
          type: integer
          format: int64
        p95_per_hour:
          type: integer
          format: int64
        peak_hour:
          type: integer
        quiet_hour:
          type: integer
      required:
      - peak_hour
      - quiet_hour
      - median_per_hour
      - p95_per_hour
      - cadence
    CountryEntry:
      type: object
      properties:
        country_code:
          type: string
        events:
          type: integer
          format: int64
        unique_ips:
          type: integer
          format: int64
      required:
      - country_code
      - unique_ips
      - events
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: X-Api-Key
      description: Private API key passed in the X-Api-Key header.
x-provenance:
  method: harvested
  publisher: Synthient API
  source: https://api.synthient.com/openapi.json
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)