Loading
Loading
The APIFreaks ASN API gives you a complete, structured view of any network operator. Pass an AS number and get back the organization's full WHOIS registration, every IPv4 and IPv6 prefix they advertise, their upstream providers, downstream customers, BGP peers, and the raw WHOIS text from the authoritative Regional Internet Registry — all in a single JSON response.
Built for security engineers building threat intelligence pipelines, network teams monitoring BGP changes, and developers adding network attribution to their products. Supports ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC.
No cached intermediaries. Every query hits the source — whichever of the five Regional Internet Registries manages that ASN. ARIN for the Americas, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America, AFRINIC for Africa. The whoisHost field tells you exactly where the data came from.
Structured fields include asName, orgName, country, allocationStatus, dateAllocated, and ASN type (ISP, BUSINESS, EDUCATIONAL, GOVERNMENT), plus full technical and abuse contacts.
The routeObjects array returns every prefix the ASN currently advertises — IPv4 and IPv6. Each entry includes the CIDR route, origin ASN, ISP name, and total IP count. The top-level numOfIPv4Routes and numOfIPv6Routes fields give you the counts upfront.
Use it to build network-level blocklists by operator, audit address space allocation, or detect unexpected prefix changes between API calls.
Three arrays cover the complete routing picture: upstreams (the transit providers carrying traffic to the internet), downstreams (networks receiving transit), and peers (direct BGP neighbors). Each entry includes AS number, description, and country.
Useful for BGP monitoring, peering policy verification, traffic engineering analysis, and attributing infrastructure during incident response.
The response includes two formats. The structured object — with clean fields for org, routes, peers, and contacts — drops straight into any application. parsedWhoisResponse breaks out the RIR contact records (handles, emails, phone numbers) for programmatic use.
The raw whoisResponse string is the complete, unprocessed text from the registry. Use it when the original source record must be preserved intact — forensic investigations, compliance documentation, or training data pipelines.
A single ASN API call surfaces the network operator behind an entire address block. Pair it with the IP Geolocation API and IP WHOIS API to build full-layer context per IP — geolocation, allocation record, and operator profile in three parallel calls. Security teams use this to attribute infrastructure by carrier or hosting provider, not just by individual IP.
Store the routeObjects array for each ASN you monitor and diff on a schedule. New prefixes, withdrawn blocks, or unexpected origin ASN changes surface immediately. The response structure is stable and consistent across all five RIRs, making this straightforward to automate.
Determine which network operator controls any IP range without maintaining your own ASN database. Pull the AS number from an IP Geolocation API response and pass it here for the operator's full profile — address space, registration details, and routing relationships — in one additional call.
If your platform surfaces network data to users — security dashboards, developer tooling, infrastructure monitoring — the structured response gives you everything you need to display ASN context alongside IP and DNS data. Clean fields, consistent schema, no parsing required.
$ pip install requestsimport requests
url = "https://api.apifreaks.com/v1.0/asn/whois/live?asn=as56554"
payload = {}
headers = {
'X-apiKey': 'API-KEY'
}
response = requests.request("GET", url, headers=headers, data=payload)
print(response.text)
Pass any AS number using the asn parameter. Both formats work — AS1234 and 1234 are identical. Case is ignored: as1234 and AS1234 return the same response.
Three parts of the response are worth knowing before you integrate:
routeObjects is an array of all CIDR prefixes the ASN advertises. Each entry has route, origin, isp, and numberOfIps. Iterate this to work with individual blocks.
upstreams, downstreams, and peers are BGP relationship arrays. Each entry has asNumber, description, and country.
parsedWhoisResponse contains the structured RIR contact data — technical and abuse contact handles, emails, and phone numbers. The raw whoisResponse string is the full unprocessed registry text.
# ASN WHOIS Lookup with prefix 'AS'# ASN WHOIS Lookup without prefix 'AS'curl -X 'GET' 'https://api.apifreaks.com/v1.0/asn/whois/live?asn=AS1234&apiKey=API-KEY'#Response { "asNumber": "1234", "asName": "FORTUM-AS", "orgName": "Fortum", "description": "Fortum", "orgHandle": "FORTUM-AS", "country": "EU", "domain": "ripe.net", "website": "http://ripe.net", "allocationStatus": "allocated", "numOfIPv4Routes": "5", "numOfIPv6Routes": "0", "whoisHost": "RIPE", "dateAllocated": "1993-09-01", "type": "BUSINESS", "routeObjects": [ { "route": "137.96.0.0/16", "origin": "AS1234", "originName": "Fortum", "isp": "Fortum Oyj", "numberOfIps": 65536 }, { "route": "132.171.128.0/17", "origin": "AS1234", "originName": "Fortum", "isp": "Fortum Oyj", "numberOfIps": 32768 }, { "route": "132.171.0.0/17", "origin": "AS1234", "originName": "Fortum", "isp": "Fortum Oyj", "numberOfIps": 32768 }, { "route": "193.110.32.0/21", "origin": "AS1234", "originName": "Fortum", "isp": "Fortum Oyj", "numberOfIps": 2048 }, { "route": "132.171.0.0/16", "origin": "AS1234", "originName": "Fortum", "isp": "Fortum Oyj", "numberOfIps": 65536 } ], "whoisResponse": " as-block: AS1234 - AS1235 descr: RIPE NCC ASN block remarks: These AS Numbers are assigned to network operators in the RIPE NCC service region. mnt-by: RIPE-NCC-HM-MNT created: 2018-11-22T15:27:09Z last-modified: 2018-11-22T15:27:09Z source: RIPE aut-num: AS1234 as-name: FORTUM-AS descr: Fortum descr: Fortum's Internet access import: from AS6667 action pref=100; accept ANY import: from AS1759 action pref=100; accept ANY export: to AS6667 announce AS1234 export: to AS1759 announce AS1234 admin-c: TT18-RIPE tech-c: JK6864-RIPE tech-c: KS2114-RIPE status: LEGACY mnt-by: TE-ENERGY-NOC created: 2002-07-01T06:59:10Z last-modified: 2017-11-15T09:13:23Z source: RIPE # Filtered person: Jari Kuusikoski address: Tietoevry Tech Services Finland Oy address: Keilalahdentie 2 address: P.O. BOX 2 address: FI-02101 ESPOO address: Finland phone: +358 40 5477 306 nic-hdl: JK6864-RIPE mnt-by: DATANET-NOC mnt-by: TE-ENERGY-NOC created: 2002-06-25T12:30:09Z last-modified: 2024-01-02T14:44:59Z source: RIPE # Filtered person: Kalevi Sinkko address: TietoEnator address: Aku Korhosentie 2 address: 00441 Helsinki phone: +358207269560 fax-no: +358-2072 69400 nic-hdl: KS2114-RIPE mnt-by: DATANET-NOC mnt-by: TE-ENERGY-NOC created: 2002-06-24T08:06:29Z last-modified: 2006-07-21T06:06:14Z source: RIPE # Filtered person: Tarmo Tuomi address: TietoEnator Co address: Aku Korhosentie 2 address: FIN-00441 HELSINKI address: FINLAND phone: +358-207269559 fax-no: +358-2072 69400 nic-hdl: TT18-RIPE created: 2002-06-17T09:38:57Z last-modified: 2016-04-05T14:33:28Z mnt-by: RIPE-NCC-LOCKED-MNT source: RIPE # Filtered ASNumber: 1234 - 1235 ASName: RIPE-ASNBLOCK-1234 ASHandle: AS1234 RegDate: 2002-10-15 Updated: 2003-04-25 Comment: These addresses have been further assigned to users in Comment: the RIPE NCC region. Contact information can be found in Comment: the RIPE database at http://www.ripe.net/whois Ref: https://rdap.arin.net/registry/autnum/1234 ResourceLink: https://apps.db.ripe.net/db-web-ui/query ResourceLink: whois.ripe.net OrgName: RIPE Network Coordination Centre OrgId: RIPE Address: P.O. Box 10096 City: Amsterdam StateProv: PostalCode: 1001EB Country: NL RegDate: Updated: 2013-07-29 Ref: https://rdap.arin.net/registry/entity/RIPE ReferralServer: whois.ripe.net ResourceLink: https://apps.db.ripe.net/db-web-ui/query OrgTechHandle: RNO29-ARIN OrgTechName: RIPE NCC Operations OrgTechPhone: +31 20 535 4444 OrgTechEmail: hostmaster@ripe.net OrgTechRef: https://rdap.arin.net/registry/entity/RNO29-ARIN OrgAbuseHandle: ABUSE3850-ARIN OrgAbuseName: Abuse Contact OrgAbusePhone: +31205354444 OrgAbuseEmail: abuse@ripe.net OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3850-ARIN ", "downstreams": [], "parsedWhoisResponse": { "status": true, "whois_server": "whois.arin.net", "aut_nums": [ { "aut_num": "1234 - 1235", "as_handle": "AS1234", "as_name": "RIPE-ASNBLOCK-1234", "tech_contacts": [ "RNO29-ARIN" ], "abuse_contacts": [ "ABUSE3850-ARIN" ], "date_created": "2002-10-15", "date_updated": "2003-04-25", "source": "https://rdap.arin.net/registry/autnum/1234" } ], "organization": { "handle": "RIPE", "name": "RIPE Network Coordination Centre", "address": [ "P.O. Box 10096", "Amsterdam", "1001EB", "NL" ], "city": "Amsterdam", "zip_code": "1001EB", "country": [ "NL" ], "date_updated": "2013-07-29", "source": "https://rdap.arin.net/registry/entity/RIPE", "addressCountry": "NL" }, "technical_contacts": [ { "handle": "RNO29-ARIN", "name": "RIPE NCC Operations", "email": [ "hostmaster@ripe.net" ], "phone": [ "+31 20 535 4444" ], "source": "https://rdap.arin.net/registry/entity/RNO29-ARIN" } ], "abuse_contacts": [ { "handle": "ABUSE3850-ARIN", "name": "Abuse Contact", "email": [ "abuse@ripe.net" ], "phone": [ "+31205354444" ], "source": "https://rdap.arin.net/registry/entity/ABUSE3850-ARIN" } ] }, "upstreams": [ { "asNumber": "AS1759", "description": "Telia Finland Oyj", "country": "FI" }, { "asNumber": "AS719", "description": "Elisa Oyj", "country": "FI" } ], "peers": [ { "asNumber": "AS6667", "description": "Elisa Oyj", "country": "FI" }, { "asNumber": "AS1759", "description": "Telia Finland Oyj", "country": "FI" }, { "asNumber": "AS719", "description": "Elisa Oyj", "country": "FI" } ], "contacts": { "emailContacts": [ "jari.kuusikoski@tietoenator.com", "kalevi.sinkko@tietoenator.com", "jari.kuusikoski@tietoevry.com", "tarmo.tuomi@tietoenator.com" ], "abuseContacts": [] }, "legacyRoutes": [] }curl -X 'GET' 'https://api.apifreaks.com/v1.0/asn/whois/live?asn=1234&apiKey=API-KEY'
If you're starting from an IP address rather than an AS number, the IP Geolocation API returns the ASN in the network.asn.as_number field of every response. For allocation-level detail on a specific IP block, the IP WHOIS API is the right call — it returns the inet_nums record including the originating ASN.
The IP WHOIS API takes an IP address and returns the allocation record for that specific subnet — who received it, when, and the contact details for that assignment. The ASN API takes an AS number and returns the operator's full network profile: all their address space, every BGP relationship, and their organizational registration.
IP WHOIS answers: "who was assigned this IP block?"
ASN API answers: "what does this entire network operator look like?"
To use the ASN Lookup API, API credits are required. Charges apply only for successful queries, indicated by a 2xx status code. If a request results in a 4xx or 5xx status code, no credits will be deducted, and any credits previously charged will be refunded.
For each successful request, 15 credits will be charged for ASN lookup. Utilize the Credits Usage API to efficiently monitor your recent consumption of both one-off and subscription credits. This API provides a streamlined way to track and manage your credit usage, ensuring you stay informed about your remaining balance and can optimize your resource allocation effectively.