API v1.0

Developer API

The checks behind the tools on this site, available over HTTP. No key, no account, no registration.

Introduction

Every endpoint below runs the same code as the corresponding tool page. There is no separate implementation and no reduced version — /api/v1/dns is the lookup the DNS checker performs, and /api/v1/email-health is the check the email tool runs.

The base URL is https://ipget.app. Every response is JSON. Successful responses carry a data object and a meta object; failures carry an error object with a stable code and a human-readable message. Nothing else is ever returned — no stack traces, no server details, no upstream vendor names.

What it is for

IP intelligence

Read the address a request arrived from, its version and whether it is globally routable — without shipping a third-party script to your users.
DNS tooling

Look up A, AAAA, CNAME, MX, TXT, NS, SOA and CAA records from a fixed resolver, for dashboards, CI checks and onboarding flows.
Security checks

Inspect the certificate a host actually serves, and read the four DNS records that decide whether a domain can send and receive mail.

Authentication

None, currently. These endpoints are open and unauthenticated. Rate limits apply per calling address.

Keys and paid tiers are planned. When they arrive, the endpoints documented here will keep working without a key at the free tier — a URL under /api/v1/ will not start demanding authentication, because that would break every client written against this page.

Response envelope

Success

{
  "data": { … },
  "meta": {
    "timestamp": "2026-08-18T21:04:11.482Z",
    "version": "1.0"
  }
}

Failure

{
  "error": {
    "code": "invalid_input",
    "message": "Enter a domain name."
  }
}

Rate limits

Limits are per calling address and per endpoint class, so exhausting the DNS budget leaves the certificate budget untouched. Every response carries the remaining allowance.

Class	Limit	Why
cheap	60 / 60s	Answered from the request itself, with no upstream lookup.
dns	30 / 60s	Each request costs at least one query to a public DNS resolver.
network	15 / 60s	Each request opens an outbound connection to the host being checked.

Every response — successful or not — includes:

X-RateLimit-Limit — requests permitted in the window.
X-RateLimit-Remaining — requests still available.
X-RateLimit-Reset — seconds until the window resets.
X-API-Version — which version answered.

A 429 additionally carries Retry-After. The standard RateLimit-* fields are sent alongside the X- forms.

Endpoints

IP address

GET /api/v1/ip

Returns the public address the request arrived from, its version, and whether it is a globally routable address.

Rate limit: 60 requests / 60s

Examples

                  curl -s "https://ipget.app/api/v1/ip"

                  const response = await fetch('https://ipget.app/api/v1/ip');
const { data, meta } = await response.json();
console.log(data, meta.version);

                  import requests

response = requests.get("https://ipget.app/api/v1/ip", timeout=20)
response.raise_for_status()
payload = response.json()
print(payload["data"])

                  <?php
$response = file_get_contents('https://ipget.app/api/v1/ip');
$payload = json_decode($response, true);
print_r($payload['data']);

                  import 'dart:convert';
import 'package:http/http.dart' as http;

final response = await http.get(Uri.parse('https://ipget.app/api/v1/ip'));
final payload = jsonDecode(response.body) as Map<String, dynamic>;
print(payload['data']);

Response

                {
  "data": {
    "ip": "93.184.216.34",
    "version": 4,
    "scope": "public"
  },
  "meta": {
    "timestamp": "2026-08-18T21:04:11.482Z",
    "version": "1.0"
  }
}

Errors

unavailable (503) — The request address could not be determined.
rate_limited (429) — The rate limit for this endpoint class was exceeded.
invalid_input (400) — A parameter was missing, malformed or out of range.
unavailable (502) — The request could not be completed. Safe to retry.

Try it

DNS lookup

GET /api/v1/dns

Looks up one record type for one domain. The resolver is fixed and the record type must be one of the supported set, so this is a lookup rather than a proxy.

Rate limit: 30 requests / 60s

Parameter	Required	Description
domain	Yes	A domain name. No protocol, path or port. Internationalised names are converted to punycode.
type	No	One of A, AAAA, CNAME, MX, TXT, NS, SOA, CAA. Defaults to A.

Examples

                  curl -s "https://ipget.app/api/v1/dns?domain=example.com"

                  const response = await fetch('https://ipget.app/api/v1/dns?domain=example.com');
const { data, meta } = await response.json();
console.log(data, meta.version);

                  import requests

response = requests.get("https://ipget.app/api/v1/dns?domain=example.com", timeout=20)
response.raise_for_status()
payload = response.json()
print(payload["data"])

                  <?php
$response = file_get_contents('https://ipget.app/api/v1/dns?domain=example.com');
$payload = json_decode($response, true);
print_r($payload['data']);

                  import 'dart:convert';
import 'package:http/http.dart' as http;

final response = await http.get(Uri.parse('https://ipget.app/api/v1/dns?domain=example.com'));
final payload = jsonDecode(response.body) as Map<String, dynamic>;
print(payload['data']);

Response

                {
  "data": {
    "domain": "example.com",
    "type": "A",
    "records": [
      { "type": "A", "value": "93.184.215.14", "ttl": 234 }
    ],
    "empty": false
  },
  "meta": {
    "timestamp": "2026-08-18T21:04:12.109Z",
    "version": "1.0",
    "cached": false
  }
}

Errors

nxdomain (404) — No DNS zone exists for that domain.
dns_timeout (504) — The resolver did not answer in time.
dns_refused (502) — The nameserver refused the query.
rate_limited (429) — The rate limit for this endpoint class was exceeded.
invalid_input (400) — A parameter was missing, malformed or out of range.
unavailable (502) — The request could not be completed. Safe to retry.

Try it

TLS certificate

GET /api/v1/ssl

Inspects the certificate a public host actually serves: issuer, validity dates, chain, subject alternative names and the negotiated cipher. Only ports that begin TLS immediately can be inspected.

Rate limit: 15 requests / 60s

Parameter	Required	Description
domain	Yes	A domain name or a full https:// URL. The path is ignored.
port	No	Defaults to 443. STARTTLS ports such as 25, 110, 143 and 587 are refused.

Examples

                  curl -s "https://ipget.app/api/v1/ssl?domain=github.com"

                  const response = await fetch('https://ipget.app/api/v1/ssl?domain=github.com');
const { data, meta } = await response.json();
console.log(data, meta.version);

                  import requests

response = requests.get("https://ipget.app/api/v1/ssl?domain=github.com", timeout=20)
response.raise_for_status()
payload = response.json()
print(payload["data"])

                  <?php
$response = file_get_contents('https://ipget.app/api/v1/ssl?domain=github.com');
$payload = json_decode($response, true);
print_r($payload['data']);

                  import 'dart:convert';
import 'package:http/http.dart' as http;

final response = await http.get(Uri.parse('https://ipget.app/api/v1/ssl?domain=github.com'));
final payload = jsonDecode(response.body) as Map<String, dynamic>;
print(payload['data']);

Response

                {
  "data": {
    "hostname": "github.com",
    "address": "140.82.121.4",
    "port": 443,
    "protocol": "TLSv1.3",
    "validity": "valid",
    "validFrom": "2026-02-05T00:00:00.000Z",
    "validTo": "2027-02-05T23:59:59.000Z",
    "daysRemaining": 171
  },
  "meta": {
    "timestamp": "2026-08-18T21:04:13.771Z",
    "version": "1.0"
  }
}

Errors

blocked_target (403) — The host resolved to a non-public address.
tls_failed (502) — The TLS handshake could not be completed.
upstream_timeout (504) — The host did not answer in time.
rate_limited (429) — The rate limit for this endpoint class was exceeded.
invalid_input (400) — A parameter was missing, malformed or out of range.
unavailable (502) — The request could not be completed. Safe to retry.

Try it

Email DNS health

GET /api/v1/email-health

Reads MX, SPF, DKIM and DMARC for a domain and returns a grade with findings. Counts SPF DNS lookups through include chains against the RFC 7208 limit of ten. Sends no mail and opens no SMTP connection.

Rate limit: 30 requests / 60s

Parameter	Required	Description
domain	Yes	A domain name.
selector	No	A DKIM selector. DKIM is only checked when one is supplied — selectors cannot be discovered from DNS.

Examples

                  curl -s "https://ipget.app/api/v1/email-health?domain=example.com"

                  const response = await fetch('https://ipget.app/api/v1/email-health?domain=example.com');
const { data, meta } = await response.json();
console.log(data, meta.version);

                  import requests

response = requests.get("https://ipget.app/api/v1/email-health?domain=example.com", timeout=20)
response.raise_for_status()
payload = response.json()
print(payload["data"])

                  <?php
$response = file_get_contents('https://ipget.app/api/v1/email-health?domain=example.com');
$payload = json_decode($response, true);
print_r($payload['data']);

                  import 'dart:convert';
import 'package:http/http.dart' as http;

final response = await http.get(Uri.parse('https://ipget.app/api/v1/email-health?domain=example.com'));
final payload = jsonDecode(response.body) as Map<String, dynamic>;
print(payload['data']);

Response

                {
  "data": {
    "domain": "google.com",
    "mx": { "present": true, "lookupFailed": false, "hosts": [{ "host": "smtp.google.com", "priority": 10 }], "ttl": 300, "nullMx": false },
    "spf": { "present": true, "lookupCount": 1, "lookupCountPartial": false, "all": "~all" },
    "dkim": { "selector": null, "present": null },
    "dmarc": { "present": true, "policy": "reject", "rua": ["mailto:mailauth-reports@google.com"] },
    "grade": "excellent",
    "issues": []
  },
  "meta": {
    "timestamp": "2026-08-18T21:04:15.003Z",
    "version": "1.0"
  }
}

Errors

nxdomain (404) — No DNS zone exists for that domain.
dns_timeout (504) — A resolver did not answer in time.
rate_limited (429) — The rate limit for this endpoint class was exceeded.
invalid_input (400) — A parameter was missing, malformed or out of range.
unavailable (502) — The request could not be completed. Safe to retry.

Try it

Roadmap

Version 1.0 is what exists today. Everything below “next” is intent rather than a commitment, and none of it is built.

now Four endpoints, open and unauthenticated, rate limited per address.
next API keys with per-key quotas, so limits follow the client rather than the network it happens to be on.
next More endpoints promoted from the internal set — reverse DNS, HTTP headers and WHOIS are the likely first three.
later Paid tiers for higher volume. The free tier stays genuinely useful; that is the point of it.
later Bulk lookups, for callers checking many domains at once rather than looping.

API questions

Do I need an API key?

No. Every endpoint below is open, unauthenticated and free to call. Rate limits are applied per calling address rather than per key. Keys and plans are on the roadmap, and when they arrive the current endpoints will keep working unauthenticated at the free tier — a v1 URL will not start requiring a key.

Is there a paid plan?

Not yet, and there is no billing code in the project. The intention is a free tier that stays genuinely useful, with paid tiers for higher volume. Until that exists, the honest answer is that these endpoints are best-effort and should not be depended on for anything critical.

What happens when I exceed a rate limit?

You get HTTP 429 with the standard error envelope and a Retry-After header. Every response, successful or not, carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset, so a well-behaved client can slow down before being refused rather than after.

Can I check private or internal hosts?

No. Every endpoint that makes an outbound connection resolves the host first and refuses private, loopback, link-local and cloud-metadata addresses, then connects to the address it validated rather than to the name. That restriction is what makes it safe to offer these publicly, and it applies to redirects too.

Do you log what I look up?

No. Domains, addresses and URLs passed to these endpoints are not stored, not logged and not sent to any analytics system. Results are cached in memory by the value looked up so a repeated query is cheap, and that cache holds no record of who asked. There is no per-request record of any kind, which is also why there are no per-customer usage statistics.

Is CORS allowed?

Yes. Every endpoint answers preflight requests and permits cross-origin reads, so you can call the API directly from a browser without a proxy.

Introduction

What it is for

IP intelligence

DNS tooling

Security checks

Authentication

Response envelope

Rate limits

Endpoints

IP address

DNS lookup

TLS certificate

Email DNS health

Roadmap

API questions