Health API and curl

Use the compatibility health endpoint while understanding its source, fields and unknown values. It is separate from the v1 snapshot API and the multi-source web model.

Updated · Egress Observatory

Requests and source

GET /api/ip/health uses Net.Coffee trust_score and feature fields. It is a compatibility endpoint, not the web v5 multi-source model or v1 local-snapshot classification. Source failures return errors, never substituted example results.

ip
Optional public IPv4/IPv6. Without it, use the trusted edge visitor address. Specify it explicitly in local development or without deployed edge context.
format
Optional json (default) or text. Other values return 400.
Terminal text output
curl -sS "https://ip.oocore.com/api/ip/health?ip=1.1.1.1&format=text"
JSON output
curl -sS "https://ip.oocore.com/api/ip/health?ip=1.1.1.1"

Structure example, not a live observation

The example uses null/unknown to show missing-field structure and an illustrative timestamp. It is not a live profile of 1.1.1.1. Text output represents null as unknown.

format=json structure
{
  "ip": "1.1.1.1",
  "checked_at": "2026-11-02T00:00:00.000Z",
  "score": null,
  "status": "unknown",
  "country": null,
  "region": null,
  "city": null,
  "isp": null,
  "asn": null,
  "flags": {
    "residential": null,
    "datacenter": null,
    "mobile": null,
    "vpn": null,
    "proxy": null,
    "tor": null,
    "crawler": null,
    "abuser": null
  }
}
format=text structure
IP health
ip: 1.1.1.1
checked_at: 2026-11-02T00:00:00.000Z
score: unknown
status: unknown
country: unknown
region: unknown
city: unknown
isp: unknown
asn: unknown
residential: unknown
datacenter: unknown
mobile: unknown
vpn: unknown
proxy: unknown
tor: unknown
crawler: unknown
abuser: unknown

Fields and errors

score is the source trust_score between 0 and 100, or null when absent. This compatibility endpoint uses thresholds 75/45 for good/moderate/poor, or unknown when absent. These bands cannot be directly converted to web quality scores and are not official platform risk results.

Invalid addresses or formats return 400. Missing trusted visitor context returns 503. Invalid or mismatched source addresses return 502. Rate limiting returns 429; reduce request frequency. Preserve errors and unknowns instead of turning them into zero scores or passes.

checked_at
The endpoint query time, not the upstream database update time.
country / region / city / isp / asn
Source-provided location and operator data, or null when missing. Registration country and usage location have different meanings.
flags.*
residential, datacenter, mobile, vpn, proxy, tor, crawler and abuser are booleans or null. A match is not automatically malicious, and a negative result does not guarantee platform access.

Current egress and scripted retesting

After switching a node, request again and compare source, address and query time. Missing data or errors cannot count as a pass. Do not make automated risk decisions from a score alone. API indexing and caching restrictions do not prevent curl usage.

Current egress (requires trusted public edge context)
curl -sS "https://ip.oocore.com/api/ip/health" | jq '{ip,score,status,isp,flags}'
Specify another target
curl -sS "https://ip.oocore.com/api/ip/health?ip=8.8.8.8"
Read a score while preserving absence
SCORE=$(curl -fsS "https://ip.oocore.com/api/ip/health?ip=$NODE_IP" | jq -er '.score // empty') || { echo "No valid score" >&2; exit 1; }

Clash health checks

Related tools and guides