Nightsec API v1

IP lookups

All requests require an API key in the Authorization header.

Authentication

Authorization: Bearer YOUR_API_KEY

Use keys from your backend. Create and revoke them in the console.

Single address

GET/v1/lookup/{ip}

Accepts an IPv4 or IPv6 address. Each valid lookup uses one unit, including a result with found: false.

curl 'https://nightsec.io/v1/lookup/203.0.113.42' \
  -H "Authorization: Bearer $NIGHTSEC_API_KEY"

Successful match

Example address and provider are illustrative.

{
  "classification": "proxy",
  "first_seen": 1792800000.0,
  "found": true,
  "ip": "203.0.113.42",
  "last_seen": 1792886400.0,
  "provider": "Example Proxy"
}

found: true returns the current observation. found: false means the address has no active record within the retention window.

Batch lookup

POST/v1/lookup

Submit 1–100 addresses. The response preserves input order, including duplicates.

curl 'https://nightsec.io/v1/lookup' \
  -H "Authorization: Bearer $NIGHTSEC_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"ips":["203.0.113.42","2001:db8::42"]}'

Results are returned in a results array. Each submitted address uses one unit. Invalid requests are rejected without charge; a batch that exceeds the remaining quota is rejected in full.

Account usage

GET/v1/me

Returns your plan, current UTC month, lookup units used and monthly quota.

curl 'https://nightsec.io/v1/me' \
  -H "Authorization: Bearer $NIGHTSEC_API_KEY"