Check VPN, proxy, and IP risk

curl --request POST \
  --url https://avraapi.com/api/v1/security/vpn-shield \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: <api-key>' \
  --header 'X-API-SECRET: <api-key>' \
  --data '
{
  "ip": "203.0.113.10"
}
'

{
  "success": true,
  "request_id": "1fa95b0c-f0da-4b07-9b1d-5235aca6ca20",
  "data": {
    "ip_address": "194.195.93.1",
    "is_vpn": true,
    "is_proxy": false,
    "is_tor": false,
    "is_relay": false,
    "is_hosting": true,
    "country_code": "US",
    "city": "San Jose",
    "asn": "AS212238",
    "network_name": "Datacamp Limited",
    "provider_name": "iplocate"
  }
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "unauthorized",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "insufficient_funds",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "validation_failed",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "rate_limit_exceeded",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "internal_error",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "service_unavailable",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

POST

security

vpn-shield

curl --request POST \
  --url https://avraapi.com/api/v1/security/vpn-shield \
  --header 'Content-Type: application/json' \
  --header 'X-API-KEY: <api-key>' \
  --header 'X-API-SECRET: <api-key>' \
  --data '
{
  "ip": "203.0.113.10"
}
'

{
  "success": true,
  "request_id": "1fa95b0c-f0da-4b07-9b1d-5235aca6ca20",
  "data": {
    "ip_address": "194.195.93.1",
    "is_vpn": true,
    "is_proxy": false,
    "is_tor": false,
    "is_relay": false,
    "is_hosting": true,
    "country_code": "US",
    "city": "San Jose",
    "asn": "AS212238",
    "network_name": "Datacamp Limited",
    "provider_name": "iplocate"
  }
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "unauthorized",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "insufficient_funds",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "validation_failed",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "rate_limit_exceeded",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "internal_error",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

{
  "success": false,
  "request_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "error": {
    "code": "service_unavailable",
    "message": "<string>",
    "details": {}
  },
  "meta": {}
}

Use this endpoint when your application needs IP-risk signals during a sign-up, login, or abuse-prevention decision. It accepts one permitted IPv4 or IPv6 address and returns a normalised result, regardless of which configured Security provider produced it.

Live Testing Guide: Before using Try it, create a Development project, then enter its Client ID and Client Secret. Configure the relevant provider for that project before sending the request.

API endpoint

POST

https://avraapi.com/api/v1/security/vpn-shield

Request fields

Field	Required	Rules
`ip`	Yes	A valid IPv4 or IPv6 address.

Outside the documentation Playground, keep the Project Client Secret on your backend. Do not call this endpoint directly from browser code, and process only IP addresses that you are permitted to use for your security workflow.

Result fields

Field	Type	Notes
`ip_address`	string	The IP address evaluated by the service.
`is_vpn`	boolean	Whether the provider classified the address as a VPN.
`is_proxy`	boolean	Whether the provider classified the address as a proxy.
`is_tor`	boolean	Whether the provider classified the address as a Tor exit node.
`is_relay`	boolean	Whether the provider classified the address as a relay.
`is_hosting`	boolean	Whether the provider classified the address as hosting or data-centre infrastructure.
`country_code`	string or `null`	Provider-reported country code, when available.
`city`	string or `null`	Provider-reported city, when available.
`asn`	string or `null`	Provider-reported autonomous-system number, when available.
`network_name`	string or `null`	Provider-reported network or organisation name, when available.
`provider_name`	string	The AvraAPI Security provider that produced the normalised result.

A false risk signal means the selected provider did not classify the address for that indicator. Combine these signals with your own risk policy; they are not a standalone decision to block or approve a user.

Request example

This example uses IPv4. The same field also accepts a valid IPv6 address, such as 2001:4860:4860::8888.

curl

curl --request POST "https://avraapi.com/api/v1/security/vpn-shield" \
  --header "X-API-KEY: YOUR_PROJECT_CLIENT_ID" \
  --header "X-API-SECRET: YOUR_PROJECT_CLIENT_SECRET" \
  --header "X-ENV: development" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data '{"ip":"203.0.113.10"}'

Response example

{
  "success": true,
  "request_id": "1fa95b0c-f0da-4b07-9b1d-5235aca6ca20",
  "data": {
    "ip_address": "194.195.93.1",
    "is_vpn": true,
    "is_proxy": false,
    "is_tor": false,
    "is_relay": false,
    "is_hosting": true,
    "country_code": "US",
    "city": "San Jose",
    "asn": "AS212238",
    "network_name": "Datacamp Limited",
    "provider_name": "iplocate"
  }
}

Error codes

HTTP	`error.code`	When it happens	What to do
`401`	`unauthorized`	Credentials are missing, invalid, inactive, or do not match the selected environment.	Check your backend secret configuration and `X-ENV`.
`402`	`insufficient_funds`	The selected Security integration requires credits that are unavailable.	Check the project’s current service configuration and balance.
`422`	`validation_failed`	`ip` is missing or is not valid IPv4/IPv6 text. The response includes field details.	Correct the request field and submit a new request.
`422`	`provider_selection_failed`	The required Security provider is unavailable for the project environment.	Enable or configure the provider for the selected environment.
`429`	`rate_limit_exceeded`	The configured request limit was reached.	Respect `Retry-After` when present; do not retry in a tight loop.
`500`	`internal_error`	The service could not complete an unexpected failure.	Retry only if your workflow permits it, retaining the request ID.
`503`	`service_unavailable`	Available upstream VPN-intelligence providers could not complete the lookup.	Retry later with the same risk workflow; do not treat an unavailable check as a safe result.
`503`	`project_paused`	The project is paused.	Reactivate the project before retrying.

Keep the JSON request_id or X-APIX-Request-ID response header with your support record. It is the safest way for AvraAPI support to trace a request.

See the REST API guide for shared credential, privacy, and error-handling guidance.

Playground resources

The generated reference below lists this endpoint’s API standard details: request fields, authorizations, and response schema. The complete integration guide, request and response examples, and endpoint-specific error handling are above.

Authorizations

X-API-KEY

string

header

required

Your Development project's Client ID. Enter your own value in the Documentation Playground.

X-API-SECRET

string

header

required

Your Development project's Client Secret. Mintlify does not proxy these requests; the browser sends them directly to AvraAPI. Never enter a Production secret in the Documentation Playground.

Headers

X-ENV

enum<string>

default:development

Selects the Development credential environment. The Documentation Playground exposes Development values only; normal backend integrations may use their documented Production credentials outside this tool.

Available options:

dev,

development

string

Requests a JSON response where the selected operation supports JSON.

Example:

"application/json"

X-Privacy-Mode

boolean

default:false

Optional privacy override. Turn this on to request that AvraAPI suppress request-payload storage in observability logs for this request.

Example:

true

Body

application/json

string<ip>

required

A valid IPv4 or IPv6 address.

Example:

"203.0.113.10"

Response

Normalised VPN and proxy risk result.

success

enum<boolean>

required

Available options:

true

request_id

string<uuid>

required

Include this value when contacting AvraAPI support.

data

object

required

Operation-specific result data.

Show child attributes

Last modified on October 1, 2026

Introduction

Currencies

SMS

Security

Location

Utilities

Check VPN, proxy, and IP risk

API endpoint

Request fields

Result fields

Request example

Response example

Error codes

Playground resources

Authorizations

Headers

Body

Response

​API endpoint

​Request fields

​Result fields

​Request example

​Response example

​Error codes

​Playground resources

Authorizations

Headers

Body

Response

API endpoint

Request fields

Result fields

Request example

Response example

Error codes

Playground resources