Free IP geolocation and risk API: limits, fields and how to call it

IP99's lookup is a free JSON API with no key and no signup: GET https://ip99.com/v1/ip/{ip}, 500 lookups per day per client IP and 60 per minute. One call returns geolocation down to the city (the district for Chinese addresses), the ASN and usage type of the network, and a risk verdict — proxy, VPN, dial-up pool, cloud phone, datacenter — with the age of the evidence behind it. IPv4 and IPv6.

Call it

curl https://ip99.com/v1/ip/8.8.8.8

The whole API is described in an OpenAPI 3.1 specification you can import into Postman, Insomnia, a code generator or a GPT action. Response (captured 2026-09-13, trimmed to the fields that matter):

{
  "ip": "8.8.8.8",
  "geo": { "continent": "NA", "country": "US", "region": "California", "city": "Mountain View",
           "lat": 37.386, "lon": -122.084, "tz": "America/Los_Angeles" },
  "network": { "asn": 15169, "usage_type": "IDC" },
  "risk": { "score": 0, "level": "none", "signals": ["hosting"] },
  "evidence_state": "none",
  "computed_at": "2026-09-13T15:40:41Z"
}

An address in China carries all three Latin names: GET /v1/ip/27.22.66.200 returns "region": "Hubei", "city": "Xiangyang" and "district": "Xiangcheng".

Fields

geo — country (ISO code), region, city, district, lat, lon, tz, continent. The key set is constant for every address: region and city are Latin place names that carry values for addresses in every country — China included; district carries a value for addresses in China only, because the English-language place-name database covers China down to the county/district level and other countries down to the city. A name the database does not have is an empty string rather than a guess.
network.asn, network.usage_type — the autonomous system and the usage type of the segment: IDC datacenter, DYN residential broadband, MOB mobile, GTW gateway / NAT egress, and others. Operator names are not published; see what is an ASN.
risk.score (0–100), risk.level (none / low / medium / high) and risk.signals — the signals that matched, as stable slugs in alphabetical order: proxy, vpn, dialup_pool, hijacked_proxy, osint, crawler, cloud_service, cloud_phone, hosting, mobile. The key is absent when nothing matched; hosting and mobile describe the network rather than risk evidence.
degraded — true only when one of the evidence sources could not be reached and the verdict was still produced from the others. It is the one field this tier carries that the professional Pulse response does not.
evidence_state — active / stale / none; computed_at — when the verdict was computed. The number measures the freshness and strength of evidence, not a probability. See what an IP risk score means.

Changed 2026-09-17 (breaking). risk now has the same shape as the professional Pulse tier: risk.tags and risk.tag_details are no longer returned, and neither is the top-level boolean signals object — matched signals are only in risk.signals. A parser that still reads the old fields gets undefined.

Limits and errors

Without a key: 500 lookups per day per client IP and 60 per minute. Everyone behind the same NAT shares the allowance.
From a browser: yes — /v1/ip/{ip} sends Access-Control-Allow-Origin: *, and the allowance counts against the visitor's own IP.
With a free account: 5000 lookups per day, keys, and usage you can see. Higher volumes and the professional evidence tier are on the pricing page.
Errors are JSON with a stable code: invalid_ip (400), rate_limited (429, per-minute), quota_exceeded_anon (429, the daily allowance, with retry_after and where to sign up). Keys go in the Authorization header; a key in the URL is rejected with key_in_query so it never lands in a log.

For AI agents

The same lookup is a Model Context Protocol tool, ip_risk_lookup, at https://ip99.com/mcp: read-only, no key needed for the free allowance. Machine-readable guidance is in llms.txt.

What the free tier does not include

Per-source evidence detail, historical verdicts (?at=) and phone-number risk profiles belong to the professional and enterprise tiers; the free lookup is the same verdict at the same freshness, without the volume. Details: API documentation · pricing.

FAQ

Is there a free IP geolocation API without a key?

Yes. GET https://ip99.com/v1/ip/{ip} needs no key and no signup: 500 lookups per day per client IP and 60 per minute, returning geolocation down to the city (the district for Chinese addresses), ASN, usage type and a risk verdict in one JSON response.

What is the rate limit?

60 requests per minute and 500 per day per client IP without a key; a free account raises the daily allowance to 5000. Over the limit the API answers 429 with a stable error code and a retry_after.

Does it support IPv6?

Yes. Both IPv4 and IPv6 addresses are accepted on the same endpoint and return the same fields.

Is the free data the same as the paid data?

The verdict and its freshness are the same. Paid plans add volume, keys and usage reporting, and the professional tier adds per-source evidence detail (every observation with its captured_at and age_min) and historical lookups at a past time (?at=). The geolocation is the same on every tier: country, region and city, plus the district for Chinese addresses.

Can I use the free API in production?

For low volumes, yes, keeping in mind that the allowance is per client IP and shared by everything behind the same NAT. For anything you depend on, a key gives you your own allowance and visibility of your usage.