x402 Machine-Payable API

Accountless, keyless IP threat intelligence for AI agents, scripts and automated systems.

Live on Base mainnet

IP intelligence that machines can buy directly.

IPIntel.ai now supports x402 payments. The first live x402 resource is IP-level threat intelligence: a client requests an IP lookup, receives an HTTP 402 Payment Required challenge, pays $0.001 USDC on Base, and receives structured JSON threat intelligence.

No account. No API key. No subscription. One HTTP request, one micro-payment, one JSON result.

GET https://api.ipintel.ai/x402/?ip=8.8.8.8
Try x402 Endpoint Classic API Docs
Price
$0.001
Asset
USDC
Network
Base
Auth
Payment
Built for machine-to-machine workflows, agent runtimes and scripts that can pay per request.
On this page

⚡ Overview

The IPIntel.ai x402 API is a machine-payable access layer for IPIntel.ai intelligence. The first live resource is IP-level threat intelligence. Additional network-level endpoints may be exposed through x402 over time.

No account No API key JSON output Base USDC Pay per lookup
  • Live service: IP threat intelligence lookup
  • Expansion: subnet, supernet and ASN endpoints planned for the x402 layer
  • Protocol: x402
  • Network: Base mainnet
  • Currency: USDC
  • Price: $0.001 USDC per IP lookup
  • Output: structured JSON threat intelligence

🧠 Why Machine-Payable IP Intelligence?

Automated systems often need a small external decision: is this IP risky, automated, hosting-based, Tor-related, proxy-like or suspicious? Traditional API onboarding is too heavy for a single lookup. x402 turns that decision into a direct machine-payable action.

1
Machine asks

A script or agent needs IP risk context before taking action.

2
Endpoint prices it

The API returns HTTP 402 with payment instructions.

3
JSON comes back

After payment, the client receives the risk score and metadata.

🔌 Endpoint Catalog

The x402 API should be treated as a payment layer for IPIntel.ai intelligence endpoints. The IP lookup endpoint is live today. Network-level endpoints may be added to the x402 layer later.

Endpoint Status Price Description
GET /x402/?ip=<ip> Live $0.001 USDC Single IP threat intelligence lookup.
GET /x402/subnet?subnet=<subnet> Planned TBD Subnet-level threat aggregation.
GET /x402/supernet?supernet=<supernet> Planned TBD Supernet-level coordinated activity intelligence.
GET /x402/asn?asn=<asn> Planned TBD ASN-level network reputation intelligence.

Planned endpoints are not active yet. They are listed to show the intended x402 expansion path. For subnet, supernet and ASN access today, use the classic API plans.

Current live endpoint:
GET https://api.ipintel.ai/x402/?ip=8.8.8.8
  • Method: GET
  • Query parameter: ip — required, IPv4 or IPv6 address
  • Authentication: none; payment is handled through x402
  • Successful response: application/json
Initial request example:
curl -i "https://api.ipintel.ai/x402/?ip=8.8.8.8"

💸 Payment Flow

x402 uses the HTTP 402 Payment Required status as the payment negotiation layer. A missing payment is not a failure; it is the API telling the client how much the resource costs.

1. Client requests a protected resource
GET https://api.ipintel.ai/x402/?ip=8.8.8.8
2. API returns an x402 payment challenge
HTTP/2 402
Content-Type: application/json

{
  "error": "X-PAYMENT header is required",
  "accepts": [
    {
      "scheme": "exact",
      "network": "base",
      "maxAmountRequired": "1000",
      "resource": "https://api.ipintel.ai/x402/?ip=8.8.8.8",
      "description": "IPIntel.ai IP threat intelligence lookup",
      "mimeType": "application/json",
      "payTo": "0x0550779CFBc832657A8BB46BAC9f359A5ad038B8",
      "maxTimeoutSeconds": 300,
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      }
    }
  ],
  "x402Version": 1
}
3. Client pays and retries with X-PAYMENT
GET https://api.ipintel.ai/x402/?ip=8.8.8.8
X-PAYMENT: <signed x402 payment payload>

📦 JSON Response

A successful x402 lookup returns IPIntel.ai threat intelligence plus payment metadata. The exact fields may vary depending on available intelligence for the requested IP. 

{
  "ip": "8.8.8.8",
  "country": "United States",
  "country_code": "US",
  "region": "California",
  "city": "Mountain View",
  "isp": "Google LLC",
  "org": "Google Public DNS",
  "asn": "AS15169",
  "as_name": "Google LLC",
  "reverse_dns": "dns.google",

  "is_tor_exit": false,
  "is_proxy": false,
  "is_hosting": true,

  "risk_score": 15,
  "threat_score": "15",
  "confidence_level": 100,
  "status": "safe",

  "risk_summary": "This IP shows low risk based on available infrastructure and behavioral signals.",
  "summary": "Public DNS resolver infrastructure with no active malicious behavior detected in IPIntel.ai signals.",

  "badges": [],
  "javascript_support": null,
  "user_agents": [],
  "verified_bot": false,

  "response_ms": 5.1,

  "payment_mode": "x402",
  "x402": {
    "paid": true,
    "network": "base",
    "currency": "USDC",
    "amount": "0.001",
    "resource": "https://api.ipintel.ai/x402/?ip=8.8.8.8"
  },
  "server_response_ms": 6.2
}

🤖 Agent Usage

This endpoint is intended for autonomous or semi-autonomous systems that need a quick IP risk decision inside a larger workflow.

Use this tool when:
  • You need a single IP risk score.
  • You need ASN, ISP, organization and geo/network context.
  • You need Tor, proxy, hosting and bot-related indicators.
  • You need a JSON result without account credentials.
  • You can pay per request with x402 on Base.
Do not use this tool when:
  • You need high-volume bulk lookups.
  • You need guaranteed attribution to a real person.
  • You need legal or law-enforcement identification.
  • You need a human-readable dashboard instead of JSON.
  • You cannot perform x402 payments.

📊 x402 vs Classic API Plans

x402 is best for individual paid lookups, agents, experiments and automation flows that do not need an account. For high-volume usage, the classic API-key plans remain more efficient.

Use case x402 API Classic API plans
Single lookup ✅ Best fit Possible, but requires account/key
AI agent / script ✅ Direct payment per request Requires key management
High-volume production Possible, but per-call priced ✅ Better fit
Subnet / supernet / ASN APIs Planned for x402 layer ✅ Available by plan
Dashboard / API key management Not needed ✅ Included

⚠️ Limits & Notes

  • The x402 API currently has one live resource: IP-level lookup.
  • Subnet, supernet and ASN lookups are planned for the x402 layer and remain available today through standard plans.
  • The endpoint evaluates IP infrastructure and behavioral risk signals, not personal identity.
  • Risk scores should be used as technical signals, not as legal attribution.
  • For high-volume usage, classic API plans may be more cost-efficient than per-call x402 payments.
Back to classic API documentation