ip-api

n8n community node for ip-api.com: geolocate and enrich IP addresses (country, ISP, ASN, proxy/hosting/mobile flags), with bulk lookups of up to 100 IPs, caching and rate limit handling.

Package Information

Released: 2 mo ago
Downloads: 0 weekly / 0 monthly
Latest Version: 0.1.0

Available Nodes

Documentation generating…

IP-API icon
IP-API
Look up IP geolocation and enrichment data with ip-api.com

Documentation

n8n-nodes-ip-api

n8n-nodes-ip-api

An n8n community node for ip-api.com: IP
geolocation and enrichment. Built as a reusable enrichment building block, not tied to any one
product: it fits SIEM alerts, firewall bans, application logins or a chat bot equally well.

What it returns

Country, region, city, ZIP code, latitude and longitude, timezone, currency, ISP, organization,
ASN (as, asname), reverse DNS, and the three flags an offline GeoIP database does not give you:
proxy (VPN or Tor), hosting (datacenter) and mobile.

Operations

Operation Endpoint Purpose
Look Up IP GET /json/{query} A single IP address or domain name
Look Up Many (Bulk) POST /batch Takes the IP from every input item, up to 100 per request
Look Up Own IP GET /json/ The public IP this n8n instance goes out with
Look Up Client DNS edns.ip-api.com/json The resolving DNS server and its geolocation

Three things the node does for you

  1. Real bulk lookups. 100 addresses in one request. Enriching 100 alerts costs one lookup, not
    one hundred.
  2. Rate-limit awareness. It reads the X-Rl (remaining) and X-Ttl (seconds to reset) headers
    and waits before exhausting them. The free endpoint allows 45 lookups per minute (15 in
    bulk) and repeated abuse leads to a one hour ban.
  3. Per-IP cache with a TTL (one hour by default). In security work the same attacking address
    repeats constantly.

The node is marked usableAsTool, so n8n also exposes an IP-API Tool variant that an AI Agent
can call on its own during triage.

Credentials are optional

Without credentials the node uses the free endpoint over http://ip-api.com. Adding an API key
switches it to https://pro.ip-api.com, served over TLS with no request limit.

The free endpoint does not allow commercial use under ip-api.com's terms, and runs without
TLS, so the addresses you look up travel in the clear. Use a pro key in production.

Typical use: enriching security alerts

[Trigger] -> [IP-API: Bulk, Field With the IP = data.srcip] -> [IF geo.proxy or geo.hosting] -> [notify]

Results are attached to each item under the geo key, leaving the original payload untouched.
Private addresses return status: "fail" with message: "private range" and do not break the flow.

Languages

The node UI ships in English. A Spanish translation is included: set N8N_DEFAULT_LOCALE=es on your
n8n instance and the node's labels, descriptions and placeholders switch to Spanish.

Translations live in nodes/IpApi/translations/<locale>/ipApi.json. The file name must match the
node's name property, which is how n8n resolves it. Note that n8n translates node parameters but
not credential fields, so the credential stays in English.

Development

npm install
npm run build          # tsc + icons + translations + dist verification
npm run lint
node tools/smoke.mjs   # 9 checks against the live API

npm run build ends with tools/verify-build.mjs, which fails the build if anything declared
(nodes, credentials, icons, translations) is missing from dist.

Do not run npm run lintfix blindly. The sentence-case autofix of
eslint-plugin-n8n-nodes-base mangles acronyms: it turned Look up many IPs in bulk into
Look up many i ps in bulk. Review the diff after any autofix.

Install (custom folder)

npm run build && npm pack
docker cp n8n-nodes-ip-api-0.1.0.tgz <container>:/tmp/
docker exec -u root <container> sh -c "cd /tmp && tar xzf n8n-nodes-ip-api-0.1.0.tgz \
  && mkdir -p /home/node/.n8n/custom/n8n-nodes-ip-api \
  && cp -r package/package.json package/dist /home/node/.n8n/custom/n8n-nodes-ip-api/ \
  && chown -R node:node /home/node/.n8n/custom"
docker compose restart n8n

Node type: CUSTOM.ipApi (and CUSTOM.ipApiTool for agents).

Related

  • n8n-nodes-ipquery - geolocation over HTTPS
    without an API key. Measured on 2026-07-28, its reputation flags are unreliable (it reported
    is_tor: false for two known Tor exit relays that this node flags as proxy: true), so the
    practical split is: ipquery for geolocation and ASN, ip-api for reputation.

License

MIT.

Discussion