API Documentation
Use our API to pull threat intelligence data in real time.
The AbuseTrack API lets you query and contribute community threat intelligence on IPs, domains, URLs, email addresses and phone numbers. Authenticated calls use an API key sent as a bearer token (Authorization: Bearer at_…; the x-api-key header is also accepted). Every authenticated call counts against your plan's daily quota - the free tier includes 3,000 requests per day.
Endpoints
| Method | Endpoint | Auth | Purpose |
|---|---|---|---|
| GET | /api/v1/lookup | API key | Return every community report matching an IP, domain, URL, email or phone number. |
| GET | /api/v1/blocklist.txt | API key | Plain-text feed of abusive IP addresses for firewalls (CrowdSec, ipset/iptables). |
| POST | /api/v1/reports | API key | Submit a new abuse report, for example straight from a fail2ban sensor. |
| GET | /api/stats | Public | Public live statistics: counts per category, threat-type distribution and recent reports. |
Integrations
Connect AbuseTrack to the security tools you already run. A couple of minutes, one command.