Map the IPs under an active decision as GeoJSON
Returns one GeoJSON point per place, listing the IPs that hold an active Ip decision of any origin and type and sent geo events from there in the window. The map shows current decisions, not ban history, and leaves out Range decisions and IPs without events in the window. Each IP shows at one place. Windows up to 24 hours, and any window with serverIn, read the raw rows and use the place of the IP's newest event. Longer windows read the per-IP aggregates and use its place in the newest bucket, the busiest one on a tie.
session<token>Session cookie authentication.
fromTimestamp?|Start of the window, inclusive, as ISO 8601 with a timezone. Defaults to 30 days before now.
toTimestamp?|End of the window, exclusive, as ISO 8601 with a timezone. Defaults to now.
countryCode?array<string>|Keep only these countries, as uppercase two-letter ISO 3166-1 codes such as NO. Repeat the parameter to pass more than one.
city?array<string>|Keep only these cities, by the exact name GeoIP gives, such as Oslo. Repeat the parameter to pass more than one.
serverIn?array<string>|Keep only rows recorded under these server names. Repeat the parameter to pass more than one.
Request fulfilled, document follows
application/json- response
A GeoJSON FeatureCollection of the IPs under an active decision.
IPs at the same coordinates share one feature, and the features are sorted by longitude, then latitude.
features*array<>stats*Totals over the IPs on the map.
type*stringcurl -X GET 'https://geometrikks.example.com/api/v1/crowdsec/banned-locations?fromTimestamp=2026-11-01T00%3A00%3A00Z&toTimestamp=2026-11-02T00%3A00%3A00Z'{ "features": [ { "geometry": { "coordinates": [ 0, 0 ], "type": "Point" }, "id": "string", "properties": { "bannedIps": [ { "city": "string", "countryCode": "string", "eventCount": 0, "ip": "string", "locationId": 0 } ], "groupId": "string", "ipCount": 0 }, "type": "Feature" } ], "stats": { "cities": 0, "countries": 0, "events": 0, "ips": 0, "locations": 0 }, "type": "FeatureCollection"}List every IP under an active decision GET
Returns each IP that holds an `Ip` decision from any origin, once, with the strongest decision type on it. `ban` beats `captcha`, which beats the rest. `/banned-ranges` lists the Range decisions.
List every range under an active decision GET
Returns each CIDR that holds a Range decision from any origin, once, with the strongest decision type on it and when that decision ends. GeoMetrikks bans a single-address DROP network with an `Ip` decision, so that network shows as its /32 or /128 while the decision lasts.