Call a keyless JSON API for your own address, or for any IP, hostname, DNS record, RDAP object or blacklist you name.
https://whatsmyip.fyi/api/v1/
The OpenAPI 3.1 document is at /api/openapi.json and is the authoritative description of every response shape. Generate a client from it rather than writing types by hand.
| Endpoint class | Limit per source address | Over the limit |
|---|---|---|
/api/v1/ip, /ip, /json, /ip.md |
1,000 per day, 60 per minute | 429 with Retry-After |
/api/v1/lookup, /dns-lookup, /rdap, /reverse, /blacklist-check |
200 per day, 20 per minute | 429, a bot challenge after 50 per day |
Privacy enrichment (?full=1, ?privacy=1) |
20 per day | Field returns null with a reason |
| Keyed tier | Per-key quota | 429 |
Every response includes the remaining quota. Read it and slow down before you are refused, rather than discovering the limit by hitting it.
Retry-After is a number of seconds and it is not a suggestion. A client that sleeps for that long recovers. A client that retries immediately stays blocked and adds load. If you use curl --retry, it already honours the header.
Within /api/v1, fields may be added and never removed. Type and meaning of an existing field will not change. Adding a field is not a breaking change, so parse defensively and ignore what you do not recognise. Anything genuinely incompatible goes to /api/v2 and v1 keeps serving.
This is free and keyless because a small request should not need a contract. The limits exist so one client cannot make it unavailable for everyone else. Two requests that would be reasonable to ask of a stranger:
/compare/ip-apis lists alternatives that make sensible fallbacks.GET/ip
The address and a trailing newline. Nothing else. This is the endpoint to paste into a shell script, because the body needs no parsing and cannot grow a field later.
No parameters.
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/ipResponse
203.0.113.45GET/json
The full record for the calling address. Served from the edge with no external call unless full=1 is set. This is the short URL; /api/v1/ip is the same response behind the version guarantee.
| Parameter | In | Required | What it does |
|---|---|---|---|
| full | query | no | Set to 1 to resolve the reverse DNS name and the privacy flags. Both cost a provider call and are metered separately at 20 per day. |
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/jsonResponse
{
"ip": "203.0.113.45",
"version": 4,
"hostname": null,
"city": "Tallinn",
"region": "Harjumaa",
"region_code": "37",
"country": "EE",
"country_name": "Estonia",
"continent": "EU",
"postal": "10111",
"loc": "59.4370,24.7536",
"timezone": "Europe/Tallinn",
"local_time": "2026-09-05T14:02:11+03:00",
"isp": "Telia Eesti",
"asn": 3249,
"as_name": "Telia Eesti AS",
"as_domain": "telia.ee",
"rir": "RIPE",
"connection_type": "residential",
"privacy": null,
"network": { "protocol": "HTTP/2", "tls": "TLSv1.3", "rtt_ms": 21, "edge": "TLL" },
"user_agent": "curl/8.7.1",
"accepts_language": null,
"geo_accuracy": "approximate",
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/ip.md
A five-line Markdown document carrying its own source URL. Written for agents and language models that handle prose better than JSON, and small enough to paste into a prompt.
No parameters.
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/ip.mdResponse
# Your public IP
IP: 203.0.113.45 (IPv4)
Location: Tallinn, Harjumaa, EE (approximate)
ISP: Telia Eesti (AS3249)
Source: https://whatsmyip.fyi/ip.mdGET/api/v1/ip
Byte-for-byte the same response as /json. Use this path in anything you will not revisit for a year, because the compatibility promise is attached to the version segment rather than to the short URL.
| Parameter | In | Required | What it does |
|---|---|---|---|
| full | query | no | Set to 1 to resolve the reverse DNS name and the privacy flags. Both cost a provider call and are metered separately at 20 per day. |
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/api/v1/ipResponse
{
"ip": "203.0.113.45",
"version": 4,
"hostname": null,
"city": "Tallinn",
"region": "Harjumaa",
"region_code": "37",
"country": "EE",
"country_name": "Estonia",
"continent": "EU",
"postal": "10111",
"loc": "59.4370,24.7536",
"timezone": "Europe/Tallinn",
"local_time": "2026-09-05T14:02:11+03:00",
"isp": "Telia Eesti",
"asn": 3249,
"as_name": "Telia Eesti AS",
"as_domain": "telia.ee",
"rir": "RIPE",
"connection_type": "residential",
"privacy": null,
"network": { "protocol": "HTTP/2", "tls": "TLSv1.3", "rtt_ms": 21, "edge": "TLL" },
"user_agent": "curl/8.7.1",
"accepts_language": null,
"geo_accuracy": "approximate",
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/headers
The headers the edge received, in the order received, each with a one-line explanation. Cookie and Authorization are replaced with a redaction marker so that a shared debugging transcript cannot leak a credential. Edge only, no external call.
No parameters.
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/api/v1/headersResponse
{
"headers": [
{ "name": "user-agent", "value": "curl/8.7.1", "redacted": false, "explanation": "The client software identifying itself." },
{ "name": "authorization", "value": "[redacted]", "redacted": true, "explanation": "Credentials. Never echoed back." }
],
"method": "GET",
"protocol": "HTTP/2",
"tls": "TLSv1.3",
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/ua
Browser, engine, operating system and device class. Parses the caller own header, or the string given in the ua parameter. Edge only, no external call, so it is cheap enough for high-frequency debugging.
| Parameter | In | Required | What it does |
|---|---|---|---|
| ua | query | no | A user agent string to parse instead of the caller own. |
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/api/v1/uaResponse
{
"user_agent": "curl/8.7.1",
"browser": { "name": "curl", "version": "8.7.1" },
"engine": { "name": null, "version": null },
"os": { "name": null, "version": null },
"device": "cli",
"bot": false,
"cli": true,
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/lookup/{target}
The IpReport shape for a target other than the caller, plus the RFC classification of the address. A hostname is resolved first and the resolved address is reported. Private, reserved and documentation ranges return the classification and an explanation rather than a geolocation guess.
| Parameter | In | Required | What it does |
|---|---|---|---|
| target | path | yes | An IPv4 address, an IPv6 address or a hostname. |
| privacy | query | no | Set to 1 to add the VPN, proxy, Tor, hosting and relay flags. Metered at 20 per day. |
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/api/v1/lookup/8.8.8.8Response
{
"ip": "8.8.8.8",
"version": 4,
"hostname": "dns.google",
"city": null,
"country": "US",
"country_name": "United States",
"isp": "Google LLC",
"asn": 15169,
"as_name": "GOOGLE",
"as_domain": "google.com",
"rir": "ARIN",
"connection_type": "hosting",
"privacy": null,
"geo_accuracy": "country-only",
"classification": {
"kind": "public",
"rfc": null,
"description": "Globally routable unicast address.",
"routable": true
},
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/dns
Queries more than one public resolver over DoH in parallel and returns each answer separately with its TTL and the DNSSEC AD flag. Answers are not reconciled. Which resolver said what is usually the information you came for.
| Parameter | In | Required | What it does |
|---|---|---|---|
| name | query | yes | The name to query. Internationalised names are converted to A-label form and both are returned. |
| type | query | no | A, AAAA, MX, TXT, NS, SOA, CAA, SRV, PTR, DNSKEY or DS. Defaults to A. |
Request
curl -s --fail --max-time 10 'https://whatsmyip.fyi/api/v1/dns?name=example.com&type=A'Response
{
"name": "example.com",
"ascii_name": "example.com",
"type": "A",
"answers": [
{
"resolver": "cloudflare",
"status": 0,
"ad": true,
"records": [{ "name": "example.com", "type": "A", "ttl": 300, "data": "93.184.215.14" }],
"error": null
},
{
"resolver": "google",
"status": 0,
"ad": true,
"records": [{ "name": "example.com", "type": "A", "ttl": 288, "data": "93.184.215.14" }],
"error": null
}
],
"agree": true,
"dnssec": true,
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/reverse/{ip}
The PTR names for an address, plus the forward lookup of each name back to an address. A PTR record alone proves nothing, because the owner of the address writes it. forward_confirmed is the field that carries weight.
| Parameter | In | Required | What it does |
|---|---|---|---|
| ip | path | yes | An IPv4 or IPv6 address. |
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/api/v1/reverse/8.8.8.8Response
{
"ip": "8.8.8.8",
"version": 4,
"arpa": "8.8.8.8.in-addr.arpa",
"hostnames": ["dns.google"],
"forward_confirmed": true,
"forward_addresses": ["8.8.8.8", "8.8.4.4"],
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/mx
MX hosts in preference order with their addresses, the SPF record with its DNS-lookup count checked against the limit of ten in RFC 7208, and the DMARC record parsed into its tags.
| Parameter | In | Required | What it does |
|---|---|---|---|
| domain | query | yes | The domain to inspect. Not a mail address. |
Request
curl -s --fail --max-time 10 'https://whatsmyip.fyi/api/v1/mx?domain=example.com'Response
{
"domain": "example.com",
"ascii_domain": "example.com",
"records": [
{ "host": "mx1.example.com", "preference": 10, "addresses": ["203.0.113.10"], "resolves": true }
],
"spf": {
"raw": "v=spf1 include:_spf.example.net -all",
"valid": true,
"version": "spf1",
"terms": [
{ "qualifier": "+", "mechanism": "include", "value": "_spf.example.net", "countsTowardLimit": true },
{ "qualifier": "-", "mechanism": "all", "value": null, "countsTowardLimit": false }
],
"modifiers": [],
"lookupCount": 1,
"exceedsLookupLimit": false,
"all": { "qualifier": "-", "mechanism": "all", "value": null, "countsTowardLimit": false },
"errors": []
},
"dmarc": {
"raw": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com",
"valid": true,
"version": "DMARC1",
"policy": "reject",
"subdomainPolicy": null,
"percent": null,
"aggregateReports": ["mailto:dmarc@example.com"],
"forensicReports": [],
"adkim": null,
"aspf": null,
"failureOptions": null,
"reportInterval": null,
"tags": { "v": "DMARC1", "p": "reject", "rua": "mailto:dmarc@example.com" },
"errors": []
},
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/ssl
Opens port 443, reads the certificate chain out of a TLS 1.2 handshake, and returns the subject, every subject alternative name, the issuer chain, the validity window with days remaining, the key type and size, the signature algorithm and the SHA-256 fingerprint. A plain HTTPS request runs alongside it for the status code, HSTS and Alt-Svc. A server that refuses TLS 1.2 returns a null certificate and the HTTPS reading alone, because a TLS 1.3 handshake encrypts the certificate.
| Parameter | In | Required | What it does |
|---|---|---|---|
| host | query | yes | The hostname to inspect. Port 443 only, public addresses only, no address literals. |
Request
curl -s --fail --max-time 10 'https://whatsmyip.fyi/api/v1/ssl?host=example.com'Response
{
"host": "example.com",
"ascii_host": "example.com",
"port": 443,
"addresses": [{ "address": "203.0.113.10", "family": "IPv4" }],
"connected_address": "203.0.113.10:443",
"certificate": {
"subject": "CN=example.com",
"subject_common_name": "example.com",
"issuer": "C=US, O=Example CA, CN=Example TLS ECC CA 3",
"issuer_common_name": "Example TLS ECC CA 3",
"issuer_organization": "Example CA",
"serial": "0624D0AB311558780B7D5213B9631831",
"version": 3,
"not_before": "2026-07-29T22:10:08Z",
"not_after": "2026-10-27T22:17:21Z",
"days_remaining": 52,
"expiry_band": "ok",
"lifetime_days": 90,
"sans": ["example.com", "*.example.com"],
"san_ips": [],
"key": { "algorithm": "EC", "bits": 256, "curve": "P-256" },
"signature_algorithm": "ecdsa-with-SHA256",
"is_certificate_authority": false,
"self_issued": false,
"extended_key_usage": ["serverAuth"],
"ocsp_responders": ["http://ocsp.example-ca.net"],
"ca_issuers": ["http://i.example-ca.net/issuer.cer"],
"fingerprint_sha256": "61:53:A9:6F:D1:A6:AB:7F:4D:43:8F:C3:49:32:48:42:99:D0:72:9D:91:40:B3:A1:26:BB:2F:9C:07:B0:22:00"
},
"chain_length": 3,
"hostname_match": { "matched": true, "matched_name": "example.com", "checked_names": ["example.com", "*.example.com"], "used_common_name": false },
"https": { "reachable": true, "method": "HEAD", "status": 200, "location": null, "strict_transport_security": "max-age=31536000", "alt_svc": null, "server": "example", "error": null },
"probe": { "certificate_read": true, "method": "tls12-clienthello", "negotiated_version": "TLS 1.2", "cipher_suite": "ECDHE-ECDSA-AES128-GCM-SHA256", "alert": null, "error": null, "elapsed_ms": 101 },
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/rdap
RDAP for an address, a domain or an AS number, flattened into one stable shape with the raw registry response kept alongside. Where a registry publishes no RDAP service the query falls back to port 43 WHOIS, and the summary says which path answered.
| Parameter | In | Required | What it does |
|---|---|---|---|
| query | query | yes | An IP address, a CIDR block, a domain name or an AS number. |
Request
curl -s --fail --max-time 10 'https://whatsmyip.fyi/api/v1/rdap?query=1.1.1.1'Response
{
"query": "1.1.1.1",
"kind": "ip",
"summary": {
"handle": "1.1.1.0 - 1.1.1.255",
"name": "APNIC-LABS",
"type": "ASSIGNED PORTABLE",
"country": "AU",
"start_address": "1.1.1.0",
"end_address": "1.1.1.255",
"cidr": ["1.1.1.0/24"],
"registry": "APNIC",
"registered": "2011-08-10T23:12:35Z",
"updated": "2024-03-06T02:46:16Z",
"status": ["active"],
"abuse_email": "helpdesk@apnic.net",
"entities": [{ "handle": "AA1412-AP", "role": "administrative", "name": "APNIC RDNS", "email": null }],
"source": "rdap"
},
"raw": {},
"cached": false,
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/blacklist/{ip}
One row per curated public blocklist, with the return code the list gave and the meaning that list documents for it. Results are cached for an hour. Every list is named, because an unattributed reputation score is not a check anyone can act on.
| Parameter | In | Required | What it does |
|---|---|---|---|
| ip | path | yes | An IPv4 or IPv6 address. |
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/api/v1/blacklist/203.0.113.45Response
{
"ip": "203.0.113.45",
"version": 4,
"listed_count": 0,
"total_count": 6,
"results": [
{
"list": "Spamhaus ZEN",
"zone": "zen.spamhaus.org",
"listed": false,
"codes": [],
"reason": null,
"lookup_url": "https://check.spamhaus.org/results/?query=203.0.113.45",
"error": null
}
],
"checked_at": "2026-09-05T14:02:11Z",
"source": "whatsmyip.fyi"
}GET/api/v1/status
The same figures the status page renders: uptime and p50 and p95 latency per target and region over the last 24 hours and the last 30 days. Poll this rather than the badge image; the badge is a picture.
No parameters.
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/api/v1/statusResponse
{
"generated_at": "2026-09-05T14:02:11Z",
"available": true,
"window": { "short_hours": 24, "long_days": 30 },
"overall": { "uptime_24h": 99.98, "uptime_30d": 99.94, "p50_ms": 34, "p95_ms": 71, "checks_24h": 864 },
"targets": [
{
"target": "https://whatsmyip.fyi/json",
"label": "/json",
"kind": "edge",
"regions": [
{
"region": "TLL",
"uptime_24h": 99.98,
"uptime_30d": 99.94,
"p50_ms": 34,
"p95_ms": 71,
"checks_24h": 288,
"checks_30d": 8640,
"last_checked_at": "2026-09-05T14:00:00Z",
"last_ok": true
}
]
}
],
"source": "whatsmyip.fyi"
}GET/api/v1/dnsleak/{session}
The resolvers that queried the authoritative server for one session token. Planned, not shipped. The route answers 404 until the authoritative responder is live, and it appears here so that the shape is settled before anything depends on it.
| Parameter | In | Required | What it does |
|---|---|---|---|
| session | path | yes | The session token handed out when the test started. Sessions are discarded after ten minutes. |
Request
curl -s --fail --max-time 10 https://whatsmyip.fyi/api/v1/dnsleak/a1b2c3d4Response
{
"error": "not_implemented",
"message": "The DNS leak session API is not live yet. See https://whatsmyip.fyi/dns-leak-test.",
"status": 404
}Every requester endpoint and the lookup base return this object. It is generated from the same schema the server validates against, so this table and openapi.json cannot drift apart. Fields are added over time and never removed, so parse defensively.
| Field | Type | Always present |
|---|---|---|
| ip | string | yes |
| version | number | number | yes |
| hostname | string or null | yes |
| city | string or null | yes |
| region | string or null | yes |
| region_code | string or null | yes |
| country | string or null | yes |
| country_name | string or null | yes |
| continent | string or null | yes |
| postal | string or null | yes |
| loc | string or null | yes |
| timezone | string or null | yes |
| local_time | string or null | yes |
| isp | string or null | yes |
| asn | number or null | yes |
| as_name | string or null | yes |
| as_domain | string or null | yes |
| rir | "ARIN" | "RIPE" | "APNIC" | "LACNIC" | "AFRINIC" | "IANA" | "UNKNOWN" | yes |
| connection_type | "residential" | "mobile" | "business" | "hosting" | "education" | "government" | "unknown" | yes |
| privacy | object | null | yes |
| network | object | yes |
| user_agent | string or null | yes |
| accepts_language | string or null | yes |
| geo_accuracy | "approximate" | "country-only" | yes |
| checked_at | string | yes |
| source | "whatsmyip.fyi" | yes |
{
"error": "rate_limited",
"message": "Rate limit exceeded. See https://whatsmyip.fyi/api for the published limits.",
"status": 429
}Every failure on every endpoint uses these three fields. error is a stable machine token, message is written for a human reading a log, andstatus repeats the HTTP status so a body copied out of context still says what happened.
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Access-Control-Allow-Headers: Accept, Content-TypeOpen on every endpoint, so browser JavaScript can call it directly. Remember what that means: the address reported is the visitor's, not your server's, and the quota is then spent per visitor.
v1.0.0
v1.0.0 published 2026-09-05. Every future addition is dated here before it is announced anywhere else.
A JSON API for the address of whoever calls it, and for lookups against any target you name. Endpoints cover the requester address, IP and hostname lookup, DNS across several resolvers, RDAP, reverse DNS, blacklist checks, a header echo, and user agent parsing. The free tier needs no key, OpenAPI 3.1 describes every response, and every response reports the quota you have left.
Last reviewed 2026-09-05.