---
updatedAt: 2026-09-18T09:34:40.000Z
agentTools:
  projectIndex: https://docs.sumsub.com/llms.txt
---

# Get IP check results

# Overview

Use this method to retrieve [IP check](/docs/advanced-ip-check) results.

## Required permissions

To use this method, your [app token](https://docs.sumsub.com/sumsub/docs/app-tokens) must have the **View check results** [permission](https://docs.sumsub.com/sumsub/docs/user-roles#permissions).

# Request example

```curl
curl -X GET \
     'https://api.sumsub.com/resources/checks/latest?type=IP_CHECK' \
     -H 'X-App-Token: <your-app-token>' \
     -H 'X-App-Access-Sig: <your-signature>' \
     -H 'X-App-Access-Ts: <unix-timestamp>'
```

# Response explained

The response represents a list of IP checks.

* [Root variables](#root-variables)
  * [ipCheckInfo](#ipcheckinfo-attributes)
  * [ipInfo attributes](#ipinfo-attributes)
* [Response example](#response-example)

## Root variables

The root variables are the core check result data items. Some of them may include nested attributes and element fields.

| Field         | Type                              | Description                                                                                     |
| :------------ | :-------------------------------- | :---------------------------------------------------------------------------------------------- |
| `answer`      | String                            | Check answer. Always `GREEN`, that means the IP check was processed and completed successfully. |
| `checkType`   | String                            | Indicates this is the `IP_CHECK` check type.                                                    |
| `createdAt`   | Date                              | Date and time (UTC) of the latest IP check result.                                              |
| `id`          | String                            | Unique identifier of the check.                                                                 |
| `ipCheckInfo` | [Object](#ipcheckinfo-attributes) | IP check parameters with results.                                                               |

## `ipCheckInfo` attributes

The following table explains the IP check parameters with results.

<Table align={["left","left","left"]}>
  <thead>
    <tr>
      <th>
        Field
      </th>

      <th>
        Type
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `ip`
      </td>

      <td>
        String
      </td>

      <td>
        IP address of the device.
      </td>
    </tr>

    <tr>
      <td>
        `ipInfo`
      </td>

      <td>
        [Object](#ipinfo-attributes)
      </td>

      <td>
        IP address related data.
      </td>
    </tr>

    <tr>
      <td>
        `internetServiceProvider`
      </td>

      <td>
        String
      </td>

      <td>
        Company name of the internet service provider.
      </td>
    </tr>

    <tr>
      <td>
        `connectionType`
      </td>

      <td>
        String
      </td>

      <td>
        Indicates the type of internet connection: `residential`, `cellular`, `business`, `hosting`, `educational`.
      </td>
    </tr>

    <tr>
      <td>
        `organization`
      </td>

      <td>
        String
      </td>

      <td>
        Legal name of the internet provider.
      </td>
    </tr>

    <tr>
      <td>
        `proxy`
      </td>

      <td>
        String
      </td>

      <td>
        Indicates whether a proxy server is used and labels it as safe (`GREEN`), suspicious (`YELLOW`), or risky (`RED`).
      </td>
    </tr>

    <tr>
      <td>
        `vpn`
      </td>

      <td>
        String
      </td>

      <td>
        Indicates whether a VPN is used and labels it as safe (`GREEN`), suspicious (`YELLOW`), or risky (`RED`).
      </td>
    </tr>

    <tr>
      <td>
        `tor`
      </td>

      <td>
        String
      </td>

      <td>
        Indicates whether the detected IP address is tunneled through other devices and labels the connection as safe (`GREEN`), suspicious (`YELLOW`), or risky (`RED`).
      </td>
    </tr>

    <tr>
      <td>
        `potentialResProxy`
      </td>

      <td>
        String
      </td>

      <td>
        Indicates whether the applicant IP address is likely a residential proxy — an IP that appears to belong to a home internet connection but is actually being used to relay traffic for anonymization.<br />
        Possible values:

        - `GREEN` — not a residential proxy.
        - `YELLOW` — medium chance of residential proxy.
        - `RED` — high chance of residential proxy.
      </td>
    </tr>

    <tr>
      <td>
        `hostingProvider`
      </td>

      <td>
        String
      </td>

      <td>
        Shows whether the applicant IP address belongs to a hosting provider rather than a regular internet service provider. A regular end user connecting from a hosting IP is unusual and often indicates a virtual machine or private proxy. Corporate VPNs also tend to fall into this category.

        Possible values:

        - `GREEN` — not a hosting-provider IP.
        - `YELLOW` — hosting-provider status could not be verified.
        - `RED` — IP belongs to a hosting provider or data center.
      </td>
    </tr>

    <tr>
      <td>
        `relay`
      </td>

      <td>
        String
      </td>

      <td>
        Shows whether the applicant connects through a relay service, such as iCloud Private Relay or Cloudflare WARP, which routes traffic through an intermediary to mask the applicant originating IP address.

        Possible values:

        - `GREEN` — relay usage not detected.
        - `YELLOW` — relay usage could not be verified.
        - `RED` — relay usage detected.
      </td>
    </tr>

    <tr>
      <td>
        `riskLevel`
      </td>

      <td>
        String
      </td>

      <td>
        Labels the detected IP address as safe (`GREEN`), suspicious (`YELLOW`), or risky (`RED`).
      </td>
    </tr>

    <tr>
      <td>
        `riskScore`
      </td>

      <td>
        Double
      </td>

      <td>
        Indicates the risk score (from 0.01 to 99) calculated by the system.
      </td>
    </tr>
  </tbody>
</Table>

## `ipInfo` attributes

The following table explains the `ipInfo` attributes representing the IP address related data.

| Field            | Type    | Description                                                                           |
| :--------------- | :------ | :------------------------------------------------------------------------------------ |
| `ip`             | String  | IP address of the device.                                                             |
| `countryCode2`   | String  | Country code (ISO 3166-1 alpha-2).                                                    |
| `countryCode3`   | String  | Country code (ISO 3166-1 alpha-3).                                                    |
| `city`           | String  | City the IP address belongs to.                                                       |
| `zipCode`        | String  | ZIP code.                                                                             |
| `state`          | String  | Name of the state or region if applicable.                                            |
| `stateCode`      | String  | Code of the state or region if applicable.                                            |
| `lat`            | Double  | Returns a double value representing the latitude of the position in decimal degrees.  |
| `lon`            | Double  | Returns a double value representing the longitude of the position in decimal degrees. |
| `asn`            | Integer | Autonomous System Number.                                                             |
| `asnOrg`         | String  | ASN organization.                                                                     |
| `riskyAsn`       | Boolean | Determines whether the ASN is risky (`true`) or not (`false`).                        |
| `riskScore`      | Double  | Indicates the risk score (from 0.01 to 99) calculated by the system.                  |
| `timezone`       | String  | Timezone in which the applicant is located.                                           |
| `connectionType` | String  | Indicates the type of internet connection.                                            |
| `proxy`          | Boolean | Determines whether a proxy server is used (`true`) or not (`false`).                  |
| `vpn`            | Boolean | Determines whether a VPN is used (`true`) or not (`false`).                           |

# Response example

```json
{
    "checks": [
        {
            "answer": "GREEN",
            "checkType": "IP_CHECK",
            "createdAt": "2025-05-28 15:42:24",
            "id": "142965bb-6775-4d85-a6ed-39aa94f7726a",
            "ipCheckInfo": {
                "ip": "33.199.219.172",
                "ipInfo": {
                    "ip": "33.199.219.172",
                    "countryCode2": "US",
                    "countryCode3": "USA",
                    "city": "Ashburn",
                    "state": "Virginia",
                    "stateCode": "US-VA",
                    "lat": 39.04,
                    "lon": -77.49,
                    "asn": 14618,
                    "asnOrg": "Amazon.com",
                    "org": "Amazon.com",
                    "riskyAsn": false,
                    "riskScore": 75.0,
                    "timezone": "America/New_York",
                    "connectionType": "hosting",
                    "proxy": true,
                    "vpn": true
                },
                "internetServiceProvider": "Amazon.com",
                "connectionType": "hosting",
                "organization": "Amazon.com",
                "proxy": "RED",
                "vpn": "RED",
                "tor": "GREEN",
                "potentialResProxy": "GREEN",
                "hostingProvider": "GREEN",
                "relay": "GREEN",
                "riskLevel": "GREEN",
                "riskScore": 75.0
            }
        }
    ]
}
```

# OpenAPI definition

```json
{
  "openapi": "3.1.0",
  "info": {
    "title": "sumsub-api",
    "version": "1.0"
  },
  "servers": [
    {
      "url": "https://api.sumsub.com"
    }
  ],
  "components": {
    "securitySchemes": {
      "sec0": {
        "type": "apiKey",
        "name": "X-App-Token",
        "in": "header",
        "x-default": ""
      }
    }
  },
  "security": [
    {
      "sec0": []
    }
  ],
  "paths": {
    "/resources/checks/latest?type=IP_CHECK": {
      "get": {
        "summary": "Get IP check results",
        "description": "",
        "operationId": "get-ip-check-results",
        "parameters": [
          {
            "name": "applicantId",
            "in": "query",
            "description": "Unique applicant identifier in the Sumsub system. <br><br>This identifier is a random combination of 24 digits and lowercase Latin characters. It is automatically generated when the applicant is created on the Sumsub side, and can be found in the [Dashboard](https://cockpit.sumsub.com/checkus/#/applicants/individual?limit=10&page=0). <br><br>If the `applicantId` is unknown to you, use the [Get applicant data (externalUserId)](https://docs.sumsub.com/sumsub/reference/get-applicant-data-via-externaluserid) method to fetch it.",
            "required": true,
            "schema": {
              "type": "string"
            }
          }
        ],
        "deprecated": false
      }
    }
  },
  "x-readme": {
    "headers": [],
    "explorer-enabled": true,
    "proxy-enabled": true
  },
  "x-readme-fauxas": true
}
```
Field	Type	Description
`ip`	String	IP address of the device.
`ipInfo`	[Object](#ipinfo-attributes)	IP address related data.
`internetServiceProvider`	String	Company name of the internet service provider.
`connectionType`	String	Indicates the type of internet connection: `residential`, `cellular`, `business`, `hosting`, `educational`.
`organization`	String	Legal name of the internet provider.
`proxy`	String	Indicates whether a proxy server is used and labels it as safe (`GREEN`), suspicious (`YELLOW`), or risky (`RED`).
`vpn`	String	Indicates whether a VPN is used and labels it as safe (`GREEN`), suspicious (`YELLOW`), or risky (`RED`).
`tor`	String	Indicates whether the detected IP address is tunneled through other devices and labels the connection as safe (`GREEN`), suspicious (`YELLOW`), or risky (`RED`).
`potentialResProxy`	String	Indicates whether the applicant IP address is likely a residential proxy — an IP that appears to belong to a home internet connection but is actually being used to relay traffic for anonymization. Possible values: - `GREEN` — not a residential proxy. - `YELLOW` — medium chance of residential proxy. - `RED` — high chance of residential proxy.
`hostingProvider`	String	Shows whether the applicant IP address belongs to a hosting provider rather than a regular internet service provider. A regular end user connecting from a hosting IP is unusual and often indicates a virtual machine or private proxy. Corporate VPNs also tend to fall into this category. Possible values: - `GREEN` — not a hosting-provider IP. - `YELLOW` — hosting-provider status could not be verified. - `RED` — IP belongs to a hosting provider or data center.
`relay`	String	Shows whether the applicant connects through a relay service, such as iCloud Private Relay or Cloudflare WARP, which routes traffic through an intermediary to mask the applicant originating IP address. Possible values: - `GREEN` — relay usage not detected. - `YELLOW` — relay usage could not be verified. - `RED` — relay usage detected.
`riskLevel`	String	Labels the detected IP address as safe (`GREEN`), suspicious (`YELLOW`), or risky (`RED`).
`riskScore`	Double	Indicates the risk score (from 0.01 to 99) calculated by the system.