Paid API

The paid /v1 API adds live residential proxy data and attribution to every answer. Send your key as a Bearer token; lookups use credits.

The paid API (/v1) returns the open answer plus live residential proxy data and the companies that run, sell and lease the address space, with the latest data on every call.

curl -H "Authorization: Bearer $KEY" https://api.layer3intel.com/v1/104.164.205.119

{
  "ip": "104.164.205.119",
  "type": "datacenter_proxy",
  "risk": {
    "score": 95,
    "level": "critical",
    "reasons": ["drop_listed", "datacenter_proxy", "recent_reassignment"]
  },
  "flags": {
    "anonymizer": true,
    "proxy": true,
    "residential_proxy": false,
    "vpn": false,
    "tor": false,
    "relay": false,
    "hosting": true
  },
  "privacy": {
    "operators": [
      { "name": "ProxyLine", "kind": "proxy-seller", "group": "proxy", "role": "operator" }
    ],
    "leased_from": [{ "name": "EGIHosting", "kind": "lessor" }]
  },
  "location": {
    "country": "NL",
    "region": "North Holland",
    "city": "Amsterdam",
    "latitude": 52.374,
    "longitude": 4.8897,
    "timezone": "Europe/Amsterdam",
    "confidence": "high"
  },
  "network": {
    "asn": 44559,
    "name": "IT Hostline Ltd",
    "type": "proxy_network",
    "prefix": "104.164.205.0/24",
    "registered": "2026-06-06",
    "rpki": "valid",
    "abuse_email": "abuse@iwihost.net",
    "drop_listed": true,
    "company": "Iwihost Net"
  },
  "routing": {
    "shape": "rotating",
    "first_seen": "2023-10-02",
    "origins": 3,
    "current_since": "2026-05-31"
  },
  "proxy_map": { "exits_24": 0, "always_on_24": 0 }
}

What the paid API adds

Added	Where
Whether the address is a residential proxy exit now	`flags.residential_proxy`, and `residential_proxy` in `risk.reasons`
The exit's score, last sighting, days seen and providers	`residential_proxy`
Proxy, VPN and Tor operators	`privacy.operators` (addresses), `operators` (prefixes, ASNs)
The lessors and brokers behind the space	`privacy.leased_from` (addresses), `leased_from` (prefixes, ASNs)
Every prefix of an ASN	`/v1/AS{n}?include=prefixes`

Get a key

Sign up at layer3intel.com and copy your API key from the dashboard. Every new account receives 10,000 free credits. Plans and prices are on the pricing page.

Send the key

Header (recommended): Authorization: Bearer YOUR_API_KEY. URLs end up in logs.
Query string: ?key=YOUR_API_KEY.

A key is 16 characters, letters and digits. A missing, malformed or unknown key gets 401 unauthorized. A key with no credits left gets 402 credits_exhausted.

/v1 is for server-to-server use. It sends no CORS headers, so browsers won't let a web page call it directly. Keep your key on your server. For lookups from a web page, use the Open API.

// On your server
const response = await fetch(`https://api.layer3intel.com/v1/${ip}`, {
  headers: { Authorization: `Bearer ${process.env.LAYER3_API_KEY}` },
});
const answer = await response.json();

if (answer.flags?.residential_proxy || answer.flags?.anonymizer) {
  // Residential proxy exit, ISP or datacenter proxy, VPN or Tor exit
}

Credits

Lookup	Cost
`/v1/{ip}`, a public IPv4 address	1 credit, always. `flags.residential_proxy` answers the question either way.
`/v1/{cidr}`, `/v1/AS{n}`	1 credit when the answer names someone the open answer doesn't: any `leased_from`, or an operator outside the `relay` and `corporate_proxy` groups. Otherwise free: the answer is the open one.
`?include=prefixes`	Free
`/v1/balance`	Free

When credits run out

Every /v1 lookup then gets 402 credits_exhausted, including prefix and ASN lookups that would have been free. /v1/balance keeps answering.

Check your balance

curl -H "Authorization: Bearer $KEY" https://api.layer3intel.com/v1/balance

{ "used": 1532, "limit": 10000, "remaining": 8468 }

Field	Type	Description
`used`	integer	Credits the key has used.
`limit`	integer or `null`	The key's credit limit. `null` for a key with no limit.
`remaining`	integer or `null`	Credits left. `null` for a key with no limit.