AbuseIPDB · Schema

AbuseIPDB Report

A single abuse report submitted to or returned from the AbuseIPDB API.

Anti MalwareBlacklistCyber SecurityIP ReputationNetwork SecurityPublic APIsThreat Intelligence

Properties

Name	Type	Description
ip	string	The reported IPv4 or IPv6 address.
categories	object	One or more AbuseIPDB category IDs (e.g. 18 for SSH Brute-Force, 22 for DDoS Attack).
comment	string	Optional human-readable description and supporting log lines. Strip secrets and PII before sending.
timestamp	string	Optional ISO 8601 timestamp of when the abuse occurred. Defaults to the moment of submission.
reporterId	integer	Identifier of the reporting account (response only).
reporterCountryCode	string	ISO 3166-1 alpha-2 country code of the reporter (response only).
reporterCountryName	string	Country name of the reporter (response only).

View JSON Schema on GitHub

JSON Schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/abuseipdb/main/json-schema/abuseipdb-report-schema.json",
  "title": "AbuseIPDB Report",
  "description": "A single abuse report submitted to or returned from the AbuseIPDB API.",
  "type": "object",
  "required": ["ip", "categories"],
  "properties": {
    "ip": { "type": "string", "description": "The reported IPv4 or IPv6 address." },
    "categories": {
      "oneOf": [
        { "type": "string", "description": "Comma-separated list of category IDs (submission form)." },
        { "type": "array", "items": { "type": "integer" }, "description": "Array of category IDs (response form)." }
      ],
      "description": "One or more AbuseIPDB category IDs (e.g. 18 for SSH Brute-Force, 22 for DDoS Attack)."
    },
    "comment": {
      "type": "string",
      "description": "Optional human-readable description and supporting log lines. Strip secrets and PII before sending."
    },
    "timestamp": {
      "type": "string",
      "format": "date-time",
      "description": "Optional ISO 8601 timestamp of when the abuse occurred. Defaults to the moment of submission."
    },
    "reporterId": { "type": "integer", "description": "Identifier of the reporting account (response only)." },
    "reporterCountryCode": { "type": "string", "description": "ISO 3166-1 alpha-2 country code of the reporter (response only)." },
    "reporterCountryName": { "type": "string", "description": "Country name of the reporter (response only)." }
  }
}