{
  "openapi": "3.0.1",
  "info": {
    "title": "IP Geolocation Lookup — Country, City, ISP & VPN Detection",
    "description": "Look up geographic location, ISP details, and security flags for any list of IP addresses -- from one to tens of thousands.",
    "version": "2.0",
    "x-build-id": "huYGJq4rEfyOhoer7"
  },
  "servers": [
    {
      "url": "https://api.apify.com/v2"
    }
  ],
  "paths": {
    "/acts/ryanclinton~ip-geolocation-lookup/run-sync-get-dataset-items": {
      "post": {
        "operationId": "run-sync-get-dataset-items-ryanclinton-ip-geolocation-lookup",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/acts/ryanclinton~ip-geolocation-lookup/runs": {
      "post": {
        "operationId": "runs-sync-ryanclinton-ip-geolocation-lookup",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor and returns information about the initiated run in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/runsResponseSchema"
                }
              }
            }
          }
        }
      }
    },
    "/acts/ryanclinton~ip-geolocation-lookup/run-sync": {
      "post": {
        "operationId": "run-sync-ryanclinton-ip-geolocation-lookup",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "inputSchema": {
        "type": "object",
        "properties": {
          "ipAddresses": {
            "title": "IP Addresses",
            "type": "array",
            "description": "List of IP addresses to look up (e.g. 8.8.8.8, 1.1.1.1). Supports both IPv4 and IPv6. Duplicates are removed automatically. Optional — you can instead supply 'rawText' (with log extraction) or a 'sourceDatasetId'.",
            "items": {
              "type": "string"
            }
          },
          "rawText": {
            "title": "Raw Log Text",
            "type": "string",
            "description": "Paste nginx / Apache / firewall / SIEM log text here. With 'Extract IPs from text' enabled, every IPv4/IPv6 address found is geolocated and scored."
          },
          "extractIpsFromText": {
            "title": "Extract IPs from text",
            "type": "boolean",
            "description": "Extract all IP addresses found in the Raw Log Text field via deterministic pattern matching.",
            "default": false
          },
          "excludePrivateIps": {
            "title": "Exclude private / reserved IPs",
            "type": "boolean",
            "description": "Drop private (10.x, 192.168.x, 172.16-31.x), loopback, link-local, and CGNAT addresses from every input source before lookup.",
            "default": false
          },
          "sourceDatasetId": {
            "title": "Source Dataset ID",
            "type": "string",
            "description": "Read IP addresses from a column of a prior Apify dataset (chain another actor's output into this one)."
          },
          "sourceDatasetField": {
            "title": "Source Dataset Field",
            "type": "string",
            "description": "Which field of the source dataset holds the IP address.",
            "default": "ip"
          },
          "providerMode": {
            "title": "Data Provider",
            "enum": [
              "auto",
              "free",
              "pro"
            ],
            "type": "string",
            "description": "'free' uses ip-api.com (HTTP, 15 req/min, non-commercial). 'pro' uses the HTTPS commercial endpoint (requires a key). 'auto' uses Pro when a key is supplied, otherwise free.",
            "default": "auto"
          },
          "ipApiProKey": {
            "title": "ip-api Pro Key",
            "type": "string",
            "description": "Your ip-api.com Pro API key. Routes lookups through the commercial-licensed HTTPS endpoint. Leave blank to use the free endpoint."
          },
          "fields": {
            "title": "Fields to Include",
            "type": "string",
            "description": "Comma-separated list of ip-api.com fields to include. Leave empty for all fields. Available: country,countryCode,region,regionName,city,zip,lat,lon,timezone,isp,org,as,asname,reverse,mobile,proxy,hosting"
          },
          "includeReverseHostname": {
            "title": "Include Reverse Hostname",
            "type": "boolean",
            "description": "Include reverse DNS hostname lookup for each IP address.",
            "default": true
          },
          "riskProfile": {
            "title": "Risk Profile",
            "enum": [
              "strict",
              "balanced",
              "lenient"
            ],
            "type": "string",
            "description": "How strictly the risk score maps to a recommended action. 'strict' escalates one step harsher (signup/payment flows), 'lenient' one step softer (analytics), 'balanced' is the default.",
            "default": "balanced"
          },
          "riskWeights": {
            "title": "Risk Weights (advanced)",
            "type": "object",
            "description": "Override the deterministic scoring weights. Defaults: proxy 70, hosting 45, mobile 10, countryDeny 40, asnDeny 60. The active model version is recorded on every record as riskModelVersion."
          },
          "countryAllowList": {
            "title": "Country Allow List",
            "type": "array",
            "description": "ISO 3166-1 alpha-2 country codes (e.g. GB, US, IE). When set, IPs resolving OUTSIDE this list are flagged and blocked by policy.",
            "items": {
              "type": "string"
            }
          },
          "countryDenyList": {
            "title": "Country Deny List",
            "type": "array",
            "description": "ISO 3166-1 alpha-2 country codes to block outright (e.g. RU, KP).",
            "items": {
              "type": "string"
            }
          },
          "asnDenyList": {
            "title": "ASN Deny List",
            "type": "array",
            "description": "Autonomous System numbers to block (e.g. AS14061, AS16276). The 'AS' prefix is optional.",
            "items": {
              "type": "string"
            }
          },
          "blockAsnCategories": {
            "title": "Block ASN Categories",
            "type": "array",
            "description": "Block by ASN category instead of number — no need to know AS numbers. Values: cloud, cdn, hosting, vpn, mobile, consumer-isp, university, government, business-isp.",
            "items": {
              "type": "string"
            }
          },
          "blockHosting": {
            "title": "Block hosting / datacenter IPs",
            "type": "boolean",
            "description": "Force a 'block' recommended action for any datacenter / cloud hosting IP.",
            "default": false
          },
          "blockProxy": {
            "title": "Block proxy / VPN IPs",
            "type": "boolean",
            "description": "Force a 'block' recommended action for any proxy, VPN, or Tor exit node.",
            "default": false
          },
          "challengeMobile": {
            "title": "Challenge mobile IPs",
            "type": "boolean",
            "description": "Force at least a 'challenge' recommended action for mobile carrier connections.",
            "default": false
          },
          "outputMode": {
            "title": "Output Mode",
            "enum": [
              "standard",
              "executive",
              "hunt"
            ],
            "type": "string",
            "description": "'standard' emits a record per IP plus the run rollups. 'executive' suppresses the per-IP rows and returns only the executive report + summary — the five-second 'what should I look at?' read.",
            "default": "standard"
          },
          "outputProfile": {
            "title": "Output Profile",
            "enum": [
              "minimal",
              "standard",
              "full"
            ],
            "type": "string",
            "description": "How much detail per record. 'minimal' returns only the decision fields. 'standard' drops long-tail network metadata. 'full' returns everything.",
            "default": "full"
          },
          "includeExecutiveReport": {
            "title": "Include Executive Report",
            "type": "boolean",
            "description": "Emit one run-level executive report record (recordType: 'executive') with a deterministic narrative: where high-risk traffic concentrates (countries, ASNs, ASN categories) and the recommended focus. Always mirrored to the EXECUTIVE_REPORT key-value store key.",
            "default": true
          },
          "autoDiscoverIpField": {
            "title": "Auto-discover IP field",
            "type": "boolean",
            "description": "When reading from a source dataset, auto-detect the IP column (ip, ipAddress, clientIp, sourceIp, remoteAddr, ...) instead of requiring 'Source Dataset Field'.",
            "default": false
          },
          "includeSummary": {
            "title": "Include Run Summary Record",
            "type": "boolean",
            "description": "Append one run-level summary record (recordType: 'summary') with cohort counts by risk level, connection type, country, ASN, and recommended action. Always mirrored to the SUMMARY key in the run's key-value store.",
            "default": true
          },
          "previousDatasetId": {
            "title": "Previous Dataset ID (diff mode)",
            "type": "string",
            "description": "Diff this run against a prior run's dataset. Each record gets a changeFlag (NEW / CHANGED / UNCHANGED) and a changes object for risk level, recommended action, connection type, and proxy/hosting flags. Ideal for scheduled threat-intel monitoring."
          },
          "reuseCachedResults": {
            "title": "Reuse cached results",
            "type": "boolean",
            "description": "Cache geolocation facts in the key-value store and reuse them on later runs. FRESHNESS CAVEAT: a cached result can be stale (an IP may have become a proxy since it was cached). Every cached record is flagged provenance.cacheHit=true. Off by default so fraud/auth decisions stay fresh.",
            "default": false
          },
          "cacheTtlHours": {
            "title": "Cache TTL (hours)",
            "type": "integer",
            "description": "How long a cached lookup stays valid when 'Reuse cached results' is on.",
            "default": 24
          },
          "generatePolicy": {
            "title": "Generate Policy & Firewall Rules",
            "type": "boolean",
            "description": "Emit a policy record (recordType: 'policy', also written to SUGGESTED_POLICY) with suggested ASN/country/IP blocks and ready-to-paste Cloudflare / nginx / iptables rules derived from where high-risk traffic concentrates.",
            "default": false
          },
          "baselineName": {
            "title": "Baseline Name (anomaly detection)",
            "type": "string",
            "description": "Name a cross-run baseline. The actor learns this stream's normal traffic distribution over scheduled runs (EWMA) and scores how far each run deviates (anomalyScore + reasons + risk trend + new ASNs). Also builds a cross-run ASN reputation that flags high-abuse ASNs per-record. First run is a baseline; anomaly detection activates from the second run."
          }
        }
      },
      "runsResponseSchema": {
        "type": "object",
        "properties": {
          "data": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "actId": {
                "type": "string"
              },
              "userId": {
                "type": "string"
              },
              "startedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "finishedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "status": {
                "type": "string",
                "example": "READY"
              },
              "meta": {
                "type": "object",
                "properties": {
                  "origin": {
                    "type": "string",
                    "example": "API"
                  },
                  "userAgent": {
                    "type": "string"
                  }
                }
              },
              "stats": {
                "type": "object",
                "properties": {
                  "inputBodyLen": {
                    "type": "integer",
                    "example": 2000
                  },
                  "rebootCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "restartCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "resurrectCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "computeUnits": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "options": {
                "type": "object",
                "properties": {
                  "build": {
                    "type": "string",
                    "example": "latest"
                  },
                  "timeoutSecs": {
                    "type": "integer",
                    "example": 300
                  },
                  "memoryMbytes": {
                    "type": "integer",
                    "example": 1024
                  },
                  "diskMbytes": {
                    "type": "integer",
                    "example": 2048
                  }
                }
              },
              "buildId": {
                "type": "string"
              },
              "defaultKeyValueStoreId": {
                "type": "string"
              },
              "defaultDatasetId": {
                "type": "string"
              },
              "defaultRequestQueueId": {
                "type": "string"
              },
              "buildNumber": {
                "type": "string",
                "example": "1.0.0"
              },
              "containerUrl": {
                "type": "string"
              },
              "usage": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "integer",
                    "example": 1
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "usageTotalUsd": {
                "type": "number",
                "example": 0.00005
              },
              "usageUsd": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "number",
                    "example": 0.00005
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}