API reference

One HTTP call tells you what an IP address is: a VPN, a proxy, a Tor exit node, a hosting provider, or an ordinary residential connection.

The whole API is three endpoints and one header: a check, the same check in batches of up to a hundred, and a look at where your plan stands. There is no SDK to install and no handshake to perform. Anything that can make an HTTP request can use it.

curl -H "Authorization: Bearer nv_live_..." \
     https://novpn.fr/v1/check/203.0.113.7
{
  "ip": "203.0.113.7",
  "score": 0.95,
  "risk": "high",
  "proxy": false,
  "vpn": true,
  "tor": false,
  "hosting": false,
  "residential_proxy": false,
  "detections": ["OpenVpn", "Vpn"],
  "network":  { "asn": "AS60068", "provider": "Datacamp Limited", "hostname": null, "cloud": null },
  "location": { "country": "Netherlands", "country_code": "NL", "continent": "Europe", "continent_code": "EU" },
  "cached": false,
  "request_id": "01JXQ..."
}

How the score is produced

Addresses are actively probed, not just matched against a list. The service opens connections to look for open HTTP and SOCKS proxies, OpenVPN endpoints and revealing reverse-DNS names, and combines those signals with autonomous-system reputation into a score between 0 and 1. Blocklists alone go stale within days; probing does not.

Probing happens in the background, never while your request is waiting. The consequence is that an address nobody has ever asked about is not known yet, and answers with a 404 rather than a score. See how to handle that in the quickstart.

What this is not

A score is evidence, not a verdict. Residential proxies and VPNs used by ordinary privacy-conscious people look similar, and mobile carrier ranges rotate constantly. Treat a high score as a reason to add friction (a challenge, a review queue) rather than as grounds to ban, unless you have decided that the false positives are acceptable for your case.

Where to go next