> ## Documentation Index > Fetch the complete documentation index at: https://docs.oathnet.org/llms.txt > Use this file to discover all available pages before exploring further. # IP Address Information > Retrieves geolocation and network info for an IP address. ## OpenAPI ````yaml /openapi.yaml get /service/ip-info openapi: 3.1.0 info: title: OathNet Service API version: 2.0.0 description: > # OathNet Service API Documentation Welcome to the OathNet Service API. This API provides breach search, stealer search, victims exploration, file search, exports, bulk search, scanners, and OSINT enrichment. ## Authentication Most `/api/service/*` endpoints require authentication via API key. Include your API key in the `x-api-key` header. ``` x-api-key: YOUR_API_KEY ``` You can obtain an API key from your dashboard at https://oathnet.org/dashboard?tab=account ## Rate Limiting & Quotas - Each request consumes from your daily lookup quota - Quota limits depend on your subscription plan - The `_meta.lookups` object in responses shows remaining daily lookups - Service-specific quotas may apply to certain endpoints ## Search Sessions For optimal quota management, initialize a search session before making service calls: 1. Call `/service/search/init` with your query 2. Use the returned `session.id` as `search_id` in subsequent service calls 3. This groups related lookups and provides better quota tracking ## Structured Filters V2 search endpoints share one structured filter contract: - use `GET` for simple searches and URL-friendly flat filters - use `POST` on the same search route when you have an AI/manual structured filter, a saved `filter_id`, or a filter tree that is awkward to URL-encode - `filter` is a JSON-encoded filter tree on query-string endpoints and a real JSON object on POST endpoints - POST search routes still take pagination, sorting, date range, `view`, and `search_id` as query parameters; the JSON body is for `filter` and `filter_id` - `filter_id` is a 24-character transient context ID returned by the AI filter flow or prior searches - explicit `filter` overrides a stored `filter_id` context, and flat params may still be used in the same request - the same filter objects are reused by AI filter responses, exports, bulk search, and scanners - advanced filters use leaf rules with `field`, `operator`, and `value`, plus `and` / `or` groups for boolean logic - supported operators are `eq`, `neq`, `contains`, `starts_with`, `ends_with`, `wildcard`, `gt`, `gte`, `lt`, `lte`, `exists`, `in`, and `not_in` See the `StructuredFilterNode` schema and `/guides/structured-filters` for the full operator list and examples. ## Success Response Patterns Successful responses use three main patterns: - Envelope JSON: Common on search-session and OSINT endpoints, plus `v2/stealer/search`, `v2/breach/search`, `v2/victims/search`, `v2/stealer/subdomain`, and `v2/bulk-search` create. - Raw JSON: Common on `v2/breach/autocomplete*`, `v2/ai/filter*`, `v2/files/search`, `v2/victims/*/properties`, `v2/victims/*/summary`, `v2/file-search*`, `v2/exports*`, `v2/bulk-search` list and status, `v2/victims/{log_id}`, `v2/phonebook`, and most scanner endpoints. - File or text stream: Victim file downloads, victim archive downloads, export downloads, and bulk-search downloads. ## Error Handling API-generated errors generally return with `success: false` and include: - `message`: Human-readable error description - `errors`: Object with field-specific or general error details Common HTTP status codes: - `200`: Success - `202`: Async job accepted - `400`: Bad Request (invalid parameters) - `401`: Unauthorized (missing or invalid token) - `403`: Forbidden (Cloudflare block or quota exceeded) - `404`: Not Found - `409`: Conflict - `429`: Too Many Requests - `500`: Internal Server Error - `502`: Bad Gateway - `503`: Service Unavailable contact: name: OathNet Support url: https://oathnet.org/support license: name: Proprietary url: https://oathnet.org/terms servers: - url: https://oathnet.org/api description: Production API Server security: - ApiKeyAuth: [] tags: - name: Search Session description: Initialize and manage search sessions for grouped lookups - name: Breach Search description: Search across breach databases for leaked credentials and data - name: Stealer Search description: Original stealer search route for simple credential lookups - name: V2 Stealer description: Enhanced V2 stealer search with advanced filtering and pagination - name: V2 Investigation description: >- Multi-section investigation across credentials, victims, evidence, files, and related credentials - name: V2 Breach description: Current breach search, autocomplete, and filter workflows - name: V2 Victims description: Search and explore victim profiles and their associated files - name: V2 File Search description: Search within victim files using regex, literal, or wildcard patterns - name: V2 File Metadata description: Search victim file metadata without fetching file bytes - name: V2 Export description: Export search results to JSONL or CSV format - name: V2 Bulk Search description: Batch many terms into an asynchronous export-style search job - name: Scanners description: >- Automated monitoring and delivery management for stealer and breach scanners - name: OSINT Lookups description: Open Source Intelligence lookups for various platforms - name: Utility description: Utility endpoints for autocomplete and other helpers paths: /service/ip-info: get: tags: - OSINT Lookups summary: IP Address Information description: Retrieves geolocation and network info for an IP address. operationId: ipInfo parameters: - name: ip in: query required: true schema: type: string example: 174.235.65.156 - name: search_id in: query schema: type: string responses: '200': description: IP information content: application/json: schema: $ref: '#/components/schemas/IpInfoResponse' example: success: true message: Request completed successfully data: status: success continent: North America continentCode: NA country: United States countryCode: US region: IL regionName: Illinois city: Chicago district: Near South Side zip: '60616' lat: 41.8536 lon: -87.6183 timezone: America/Chicago offset: -21600 currency: USD isp: Verizon Business org: Verizon Business as: AS6167 Verizon Business asname: CELLCO-PART reverse: 156.sub-174-235-65.myvzw.com mobile: true proxy: false hosting: false query: 174.235.65.156 _meta: user: plan: Pro plan_type: pro is_plan_active: true lookups: used_today: 10 left_today: 99989 daily_limit: 99999 is_unlimited: false components: schemas: IpInfoResponse: type: object properties: success: type: boolean message: type: string data: type: object properties: status: type: string description: Query status example: success query: type: string description: The queried IP address continent: type: string example: North America continentCode: type: string example: NA country: type: string example: United States countryCode: type: string example: US region: type: string example: IL regionName: type: string example: Illinois city: type: string example: Chicago district: type: string description: City district/neighborhood example: Near South Side zip: type: string example: '60616' lat: type: number example: 41.8536 lon: type: number example: -87.6183 timezone: type: string example: America/Chicago offset: type: integer description: UTC offset in seconds example: -21600 currency: type: string example: USD isp: type: string example: Verizon Business org: type: string example: Verizon Business as: type: string description: AS number and organization example: AS6167 Verizon Business asname: type: string description: AS name example: CELLCO-PART reverse: type: string description: Reverse DNS example: 156.sub-174-235-65.myvzw.com mobile: type: boolean description: Is mobile network example: true proxy: type: boolean description: Is proxy/VPN example: false hosting: type: boolean description: Is hosting/datacenter example: false _meta: $ref: '#/components/schemas/ResponseMeta' ResponseMeta: type: object description: Metadata included in all API responses properties: user: type: object properties: plan: type: string description: User's plan name example: Pro plan_type: type: string description: Plan type identifier example: pro is_plan_active: type: boolean example: true lookups: type: object properties: used_today: type: integer description: Lookups used today example: 5 left_today: type: integer description: Lookups remaining today example: 995 daily_limit: type: integer description: Daily lookup limit example: 1000 is_unlimited: type: boolean example: false service: type: object properties: name: type: string example: Service Name id: type: string example: service-id category: type: string example: general is_premium: type: boolean example: false is_available: type: boolean example: true session_quota: type: integer example: 10 performance: type: object properties: duration_ms: type: number description: Request duration in milliseconds example: 111.47 timestamp: type: string format: date-time example: '2026-01-06T00:44:08.191547' securitySchemes: ApiKeyAuth: type: apiKey in: header name: x-api-key description: API key for authentication (lowercase header name) ````