Skip to content
SipRadarDocs

API Reference_

SipRadar REST API

Quick start

Authenticate and make your first request

All API requests require a Bearer token. Generate keys from your dashboard after signing up. Base URL is stable across all v1 endpoints.

Base URL

https://api.sipradar.net

Authentication

Authorization: Bearer sk_live_...
Content-Type: application/json

First request

$ curl -H "Authorization: Bearer sk_live_..." \
     https://api.sipradar.net/v1/ip/185.243.115.84

Endpoints

API reference

Five stable v1 endpoints. OpenAPI 3.1 schema available in your dashboard.

GET/v1/ip/{addr}

IP reputation lookup

Returns honeypot reputation, threat score, attack pattern, geo, and ASN for a single IPv4 address.

Parameters

addr *

In: path

Type: string

IPv4 address to look up.

Request

curl -H "Authorization: Bearer sk_live_..." \
     https://api.sipradar.net/v1/ip/185.243.115.84

Response

{
  "ip": "185.243.115.84",
  "malicious": true,
  "score": 98,
  "first_seen": "2026-05-02T11:14:07Z",
  "last_seen": "2026-07-15T09:42:11Z",
  "hits": 4127,
  "pattern": "sip-register-bruteforce",
  "asn": "AS49505",
  "country": "RU"
}
GET/v1/threats

Live threat event stream

Rolling stream of honeypot events. Filter by port, country, and minimum threat score. Supports long-poll and WebSocket on Active Defense+.

Parameters

limit

In: query

Type: integer

Max events to return (default 50, max 500).

min_score

In: query

Type: integer

Minimum threat score 0–100.

port

In: query

Type: integer

Filter by SIP port (5060, 5061, etc.).

country

In: query

Type: string

ISO 3166-1 alpha-2 country code.

Request

curl -H "Authorization: Bearer sk_live_..." \
     "https://api.sipradar.net/v1/threats?limit=50&min_score=60"

Response

{
  "events": [
    {
      "ip": "185.243.115.84",
      "port": 5060,
      "country": "RU",
      "user_agent": "SIPVicious",
      "score": 98,
      "pattern": "sip-register-bruteforce",
      "ts": "2026-07-15T09:42:11Z"
    }
  ],
  "meta": { "buffer": 60, "streaming": true }
}
POST/v1/scan

PBX security audit

Kick off an on-demand PBX audit against a public SIP endpoint. Returns a job ID and optional webhook callback.

Parameters

target *

In: body

Type: string

Hostname or IP of the SIP endpoint.

platform *

In: body

Type: string

asterisk | kamailio | 3cx | freeswitch | opensips | freepbx

webhook_url

In: body

Type: string

HTTPS URL for scan.completed webhook.

Request

curl -X POST https://api.sipradar.net/v1/scan \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"target":"pbx.example.com","platform":"asterisk"}'

Response

{
  "job_id": "scan_7f3a9c2e",
  "status": "queued",
  "target": "pbx.example.com",
  "platform": "asterisk",
  "eta_seconds": 45
}
GET/v1/blacklist.txt

Plain-text SIP blacklist

Plain-text list of malicious IPs for Fail2Ban, iptables, or nftables. Refreshes every 60 seconds. One IP per line.

Request

curl -H "Authorization: Bearer sk_live_..." \
     https://api.sipradar.net/v1/blacklist.txt

Response

185.243.115.84
77.83.36.219
5.188.86.174
222.186.42.155
POST/v1/report

Submit suspicious activity

Submit a suspicious IP or raw SIP payload to the honeypot network for analysis and reputation scoring.

Parameters

ip *

In: body

Type: string

Source IP address.

payload

In: body

Type: string

Raw SIP message (base64-encoded).

notes

In: body

Type: string

Optional context for analysts.

Request

curl -X POST https://api.sipradar.net/v1/report \
  -H "Authorization: Bearer sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"ip":"203.0.113.42","notes":"REGISTER flood on port 5060"}'

Response

{
  "report_id": "rpt_a8f2c1d0",
  "status": "queued",
  "queued_at": "2026-07-15T10:22:00Z"
}

Rate limits

Per-plan request limits

Rate limits apply per API key. Webhook and WebSocket streaming are available on Active Defense and Enterprise.

  • Community

    Requests / min
    100 / month
    WebSocket
    n/a
    Bulk lookup
    1 IP per request

  • Single PBX

    Requests / min
    Real-time
    WebSocket
    n/a
    Bulk lookup
    1 IP per request

  • Active Defense

    Requests / min
    Unlimited
    WebSocket
    Yes
    Bulk lookup
    Batch supported

  • Enterprise

    Requests / min
    Unlimited (dedicated pool)
    WebSocket
    Yes
    Bulk lookup
    Custom batch size

Webhooks

Event-driven integrations

Configure webhook URLs in your dashboard. All payloads are signed with HMAC-SHA256 using your webhook secret.

scan.completed

Fired when a PBX audit job finishes. Payload includes full remediation report.

{
  "event": "scan.completed",
  "job_id": "scan_7f3a9c2e",
  "target": "pbx.example.com",
  "critical_findings": 2,
  "report_url": "https://api.sipradar.net/v1/scan/scan_7f3a9c2e/report"
}
scan.failed

Fired when a PBX audit cannot complete (timeout, ownership verification failed).

{
  "event": "scan.failed",
  "job_id": "scan_7f3a9c2e",
  "target": "pbx.example.com",
  "reason": "ownership_verification_failed"
}
threat.high_score

Fired when a new honeypot event exceeds your configured score threshold.

{
  "event": "threat.high_score",
  "ip": "185.243.115.84",
  "score": 98,
  "pattern": "sip-register-bruteforce",
  "ts": "2026-07-15T09:42:11Z"
}

SDKs

Official client libraries

Native SDKs for PHP, Python, and Node.js. OpenAPI 3.1 schema and Postman collection available in the dashboard.

PHP

composer require sipradar/sdk

<?php
use SipRadar\Client;

$client = new Client('sk_live_...');
$result = $client->ip()->lookup('185.243.115.84');
echo $result->score; // 98

Python

pip install sipradar

from sipradar import SipRadar

client = SipRadar(api_key="sk_live_...")
result = client.ip.lookup("185.243.115.84")
print(result.score)  # 98

Node.js

npm install @sipradar/sdk

import { SipRadar } from '@sipradar/sdk';

const client = new SipRadar({ apiKey: 'sk_live_...' });
const result = await client.ip.lookup('185.243.115.84');
console.log(result.score); // 98

Errors

HTTP status codes

All errors return JSON with an error object containing code, message, and request_id.

  • 401Unauthorized

    Missing or invalid Bearer token.

  • 403Forbidden

    Valid token but insufficient plan permissions for this endpoint.

  • 404Not Found

    Resource does not exist (e.g. unknown IP with no reputation data).

  • 429Too Many Requests

    Rate limit exceeded. Retry-After header indicates wait time in seconds.

  • 500Internal Server Error

    Unexpected server error. Contact support with the X-Request-Id header.

Get started_

Generate your API key and start integrating.

Community tier includes 1 PBX scan/month, 100 API lookups, and a 48-hour delayed threat feed, free forever.

Get an API keyView threat feed