Skip to Content
ReferenceAPI referenceCrowdSec

List the active decisions that cover one IP

GET
/api/v1/crowdsec/decisions/lookup

Returns every active decision on the IP, from any origin, including Range decisions that hold it. This endpoint does not look up places, so the country and city fields are null and requestCount24h is 0 on Ip decisions.

Authorization

cookiesession<token>

Session cookie authentication.

Query Parameters

ip*string

The IP to look up. A value that is not an IP gets a 400.

Response Body

Request fulfilled, document follows

application/json
  1. response
[index: integer]?

One active CrowdSec decision.

Example Request
curl -X GET 'https://geometrikks.example.com/api/v1/crowdsec/decisions/lookup?ip=string'
Example Response
[  {    "city": "string",    "countryCode": "string",    "countryName": "string",    "duration": "string",    "id": 0,    "ip": "string",    "origin": "string",    "requestCount24h": 0,    "scenario": "string",    "scope": "string",    "type": "string"  }]

List active CrowdSec decisions, one row per target GET

Returns the active decisions grouped by target, in the order the LAPI lists them, paged with `currentPage` and `pageSize`. `total` counts targets, not decisions. The country, city and 24-hour request count come from GeoMetrikks' own access logs of the last 30 days, and the GeoIP database fills in the place for an IP the logs do not locate.

Get the CrowdSec alert behind a decision GET

Returns the alert that made the decision, in the same shape as `/alerts/{alert_id}`. The LAPI finds alerts by IP only, so pass the decision's IP too. This endpoint does not search the community blocklist alerts, so a blocklist decision gets a 404. Answers 403 when the server has no CrowdSec machine credentials, CROWDSEC_MACHINE_ID and CROWDSEC_MACHINE_PASSWORD.