n8n-nodes-ip-api

An n8n community node for ip-api.com: IP geolocation and enrichment. Built as a reusable enrichment building block, not tied to any one product: it fits SIEM alerts, firewall bans, application logins or a chat bot equally well.

What it returns

Country, region, city, ZIP code, latitude and longitude, timezone, currency, ISP, organization, ASN (as, asname), reverse DNS, and the three flags an offline GeoIP database does not give you: proxy (VPN or Tor), hosting (datacenter) and mobile.

Operations

| Operation | Endpoint | Purpose | |---|---|---| | Look Up IP | GET /json/{query} | A single IP address or domain name | | Look Up Many (Bulk) | POST /batch | Takes the IP from every input item, up to 100 per request | | Look Up Own IP | GET /json/ | The public IP this n8n instance goes out with | | Look Up Client DNS | edns.ip-api.com/json | The resolving DNS server and its geolocation |

Three things the node does for you

1. Real bulk lookups. 100 addresses in one request. Enriching 100 alerts costs one lookup, not one hundred.
2. Rate-limit awareness. It reads the X-Rl (remaining) and X-Ttl (seconds to reset) headers and waits before exhausting them. The free endpoint allows 45 lookups per minute (15 in bulk) and repeated abuse leads to a one hour ban.
3. Per-IP cache with a TTL (one hour by default). In security work the same attacking address repeats constantly.

The node is marked usableAsTool, so n8n also exposes an IP-API Tool variant that an AI Agent can call on its own during triage.

Credentials are optional

Without credentials the node uses the free endpoint over http://ip-api.com. Adding an API key switches it to https://pro.ip-api.com, served over TLS with no request limit.

The free endpoint does not allow commercial use under ip-api.com's terms, and runs without TLS, so the addresses you look up travel in the clear. Use a pro key in production.

Typical use: enriching security alerts

[Trigger] -> [IP-API: Bulk, Field With the IP = data.srcip] -> [IF geo.proxy or geo.hosting] -> [notify]

Results are attached to each item under the geo key, leaving the original payload untouched. Private addresses return status: "fail" with message: "private range" and do not break the flow.

Languages

The node UI ships in English. A Spanish translation is included: set N8N_DEFAULT_LOCALE=es on your n8n instance and the node's labels, descriptions and placeholders switch to Spanish.

Translations live in nodes/IpApi/translations/<locale>/ipApi.json. The file name must match the node's name property, which is how n8n resolves it. Note that n8n translates node parameters but not credential fields, so the credential stays in English.

Development

npm install
npm run build          # tsc + icons + translations + dist verification
npm run lint
node tools/smoke.mjs   # 9 checks against the live API

npm run build ends with tools/verify-build.mjs, which fails the build if anything declared (nodes, credentials, icons, translations) is missing from dist.

Do not run npm run lintfix blindly. The sentence-case autofix of eslint-plugin-n8n-nodes-base mangles acronyms: it turned Look up many IPs in bulk into Look up many i ps in bulk. Review the diff after any autofix.

Install (custom folder)

npm run build && npm pack
docker cp n8n-nodes-ip-api-0.1.0.tgz <container>:/tmp/
docker exec -u root <container> sh -c "cd /tmp && tar xzf n8n-nodes-ip-api-0.1.0.tgz \
  && mkdir -p /home/node/.n8n/custom/n8n-nodes-ip-api \
  && cp -r package/package.json package/dist /home/node/.n8n/custom/n8n-nodes-ip-api/ \
  && chown -R node:node /home/node/.n8n/custom"
docker compose restart n8n

Node type: CUSTOM.ipApi (and CUSTOM.ipApiTool for agents).

Related

• n8n-nodes-ipquery - geolocation over HTTPS without an API key. Measured on 2026-07-28, its reputation flags are unreliable (it reported is_tor: false for two known Tor exit relays that this node flags as proxy: true), so the practical split is: ipquery for geolocation and ASN, ip-api for reputation.

License

MIT.