API reference/Lookup endpoints

Lookup endpoints

Fetch a full report for an IP address, prefix or AS number.

One report, four ways to ask for it.

Endpoint	Subject
`GET /api/v1/lookup?q={query}`	Anything the search bar accepts: an IP, a CIDR prefix, or an AS number.
`GET /api/v1/ip/{ip}`	An IP address.
`GET /api/v1/prefix/{net}/{len}`	A CIDR prefix, split into network and length.
`GET /api/v1/asn/{asn}`	An AS number, with or without the AS prefix.

All four return the same JSON report, documented field by field in The lookup report. The path forms exist so you can build URLs without query string encoding; /lookup?q= is the general form. The shallow, offline and refresh parameters described on the API overview apply to all four.

Examples

curl

curl "https://subnethistory.com/api/v1/lookup?q=185.220.101.42"

javascript

const res = await fetch(
  "https://subnethistory.com/api/v1/lookup?q=" + encodeURIComponent("185.220.101.42")
);
const report = await res.json();

for (const insight of report.insights) {
  console.log(`[${insight.level}] ${insight.lead} ${insight.text}`);
}

python

import requests

report = requests.get(
    "https://subnethistory.com/api/v1/lookup",
    params={"q": "185.220.101.42"},
    timeout=60,
).json()

print(report["query"]["normalized"], report["meta"]["partial"])

The response at a glance

Key	What it holds
`query`	What you asked, as interpreted and normalised.
`ip`	The address and family, for address lookups. Flags special use space.
`registration`	The registry record: holder, contacts, dates, parents, raw whois.
`routing`	Announcement status, origin, RPKI, surrounding announcements.
`asn`	The full network profile of the origin AS.
`originHistory`	Every AS that ever originated the space, one row each.
`intel`	Per address intelligence sampling: verdicts, risk, agreement, trends, and the active-check block summary.
`timeline`	Every dated event, merged and sorted.
`insights`	Plain language findings with levels and stable codes.
`tags`	Confirmed and suggested labels, and the worst severity.
`sources`	Provenance per dataset, including cache state.
`meta`	Timing, cache and truncation information.

Behaviour worth knowing

Cold lookups are slow, once. The first lookup of a subject fans out to six sources and can take up to about 30 seconds. Everything is cached; repeats are instant. Use the streaming endpoint to show real progress instead of a spinner.
meta.partial. When true, a dataset was still pending or had failed at response time. meta.pendingDatasets and meta.failedDatasets say which, and meta.retryAfterMs says how long to wait. Stragglers finish in the background and land in the cache. A failed source is left alone for a few minutes before it is called again, so a repeat sooner than retryAfterMs returns the same report.
Special use space answers instantly. Private, loopback, CGNAT and similar reserved ranges return a report that explains the range instead of registry data, with a single info insight.
A bare address is not a /32. Looking up an address returns address level facts plus its covering block; look up the prefix itself for block level history.

Last updated 2026-08-15subnethistory.com