ThreatPoint API Documentation

# Query ThreatPoint API with forward/reverse DNS and WHOIS validation
curl -X GET "https://api.threatpoint.co.uk/api/v1/resources/ip?ipaddress=185.220.101.5&iptoname=y&ipwhois=y" \
  -H "X-Api-Key: tp_live_your_api_key_here" \
  -H "Accept: application/json"

// Node.js (v18+ with native fetch)
async function checkIpReputation(clientIp) {
  const endpoint = new URL('https://api.threatpoint.co.uk/api/v1/resources/ip');
  endpoint.searchParams.append('ipaddress', clientIp);
  endpoint.searchParams.append('iptoname', 'y');
  endpoint.searchParams.append('ipwhois', 'y');

  const res = await fetch(endpoint.toString(), {
    method: 'GET',
    headers: {
      'X-Api-Key': process.env.THREATPOINT_API_KEY,
      'Accept': 'application/json'
    }
  });

  if (res.status === 429) {
    // Account query allocation reached
    console.warn('ThreatPoint query volume quota exceeded');
    return { allowed: false, reason: 'QUOTA_EXCEEDED' };
  }

  if (!res.ok) throw new Error(`API Error: ${res.status}`);

  const data = await res.json();
  const isThreat = data.risk_score >= 80 || data.reason_codes.includes('TOR_EXIT');

  return { allowed: !isThreat, data };
}

import os
import requests

THREATPOINT_KEY = os.getenv("THREATPOINT_API_KEY")
BASE_URL = "https://api.threatpoint.co.uk/api/v1/resources/ip"

def evaluate_ip(ip_address: str, check_dns: bool = True, check_whois: bool = True) -> dict:
    headers = {"X-Api-Key": THREATPOINT_KEY}
    params = {
        "ipaddress": ip_address,
        "iptoname": "y" if check_dns else "n",
        "ipwhois": "y" if check_whois else "n"
    }

    response = requests.get(BASE_URL, headers=headers, params=params, timeout=5.0)

    if response.status_code == 401:
        raise PermissionError("Unauthorized: Invalid ThreatPoint API Key")
    elif response.status_code == 429:
        raise RuntimeError("Rate Limit Exceeded: Volume allowance reached")
    elif response.status_code != 200:
        response.raise_for_status()

    return response.json()