Bulk Simple Best API
The Bulk Simple Best API allows to fetch a single result, the best matching one, by providing a list contained within a text file. You have to provide a unique value for the asset, which can only be an IP address. You can just pass the asset value and not a full ONYPHE Query Language search. Only a few categories are useful in this context, which are the following:
- /bulk/simple/geoloc/best/ip: you have to give a completely valid list of IPv4 or IPv6 addresses (example: 184.108.40.206);
- /bulk/simple/inetnum/best/ip: you have to give a completely valid list of IPv4 or IPv6 addresses (example: 220.127.116.11);
- /bulk/simple/whois/best/ip: you have to give a completely valid list of IPv4 or IPv6 addresses (example: 18.104.22.168);
- /bulk/simple/threatlist/best/ip: you have to give a completely valid list of IPv4 or IPv6 addresses (example: 22.214.171.124).
Bulk Simple Best Geoloc, Inetnum & Whois Best endpoints will return the geolocation of the given address, and the smallest network (subnet field) will be the best match.
Bulk Simple Best Threatlist Best will return a result if an entry has been found in threatlist category within the last 48-hours. The idea behind this endpoint is that you want to know if an address has been considered as malicious in the past few days only. IP addresses are sometimes cleaned-up and do not pose a threat anymore.
You can use curl in the following way to call the Bulk Simple Best API:
echo '126.96.36.199' > /tmp/ip.txt echo '188.8.131.52' >> /tmp/ip.txt curl -H 'Content-Type: application/json' -H 'Authorization: bearer YOUR_APIKEY' -XPOST 'https://www.onyphe.io/api/v2/bulk/simple/whois/best/ip' --data-binary @/tmp/ip.txt
Using curl against Unrated API endpoint
If you want to query against the Unrated API endpoint, you have to pass the API key as an HTTP parameter as the Authorization header will be used to store Basic authentication credentials based on your login email address and your API key as a password:
LOGIN=`echo -n YOUR_LOGIN_EMAIL | sed 's/@/_/g'` PASS=YOUR_APIKEY BASIC=`echo -n $LOGIN:$PASS | base64 -w 0` curl -H 'Content-Type: application/json' -H "Authorization: basic $BASIC" -XPOST 'https://www.onyphe.io/unrated/api/v2/bulk/simple/whois/best/ip?k=YOUR_APIKEY' --data-binary @/tmp/ip.txt