id: ipinfo
name: IPinfo
version: 1.0.0
description: "IPinfo Core API — IP address enrichment: geolocation, ASN / network details, and privacy/network flags (hosting, mobile, anycast, satellite)."
changelog: "1.0.0 — Initial release: IP lookup, single-field lookup, own IP, batch, and connectivity test."
category: enrichment

config_schema:
  properties:
    base_url:
      type: string
      description: IPinfo Core API base URL
      default: https://api.ipinfo.io
    token:
      type: string
      description: IPinfo API access token (Account → Token)
      x-soar-sensitive: true
  required:
    - token

# IPinfo authenticates with the access token as the `token` query parameter.
auth:
  - id: apikey
    type: api_key
    in: query
    name: token
    value_template: "{{secret}}"
    secret_field: token

commands:
  - id: lookup_ip
    name: ipinfo-lookup-ip
    description: Full enrichment for an IP — geolocation, ASN/network, and privacy/network flags.
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IPv4 or IPv6 address" }
      required: [ip]
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lookup/{ip}
      auth_ref: apikey

  - id: lookup_field
    name: ipinfo-lookup-field
    description: A single field for an IP (e.g. city, country, hostname, as).
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address" }
        field: { type: string, description: "Field name, e.g. city, country, hostname, as" }
      required: [ip, field]
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lookup/{ip}/{field}
      auth_ref: apikey

  - id: lookup_me
    name: ipinfo-lookup-me
    description: Details for the IP address making the request.
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lookup/me
      auth_ref: apikey

  # Code-first: the batch endpoint takes a raw JSON array body, which the
  # form-based generator (object body) cannot produce. See scripts/batch.py.
  - id: batch
    name: ipinfo-batch
    description: Look up multiple IPs (or IP/field paths) in a single request.
    risk: read
    inputs_schema:
      properties:
        ips: { type: string, description: "Comma-separated IPs or lookup paths, e.g. '8.8.8.8,1.1.1.1,8.8.4.4/country'" }
      required: [ips]
    outputs_schema: { properties: {} }

  - id: test_connection
    name: ipinfo-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lookup/me
      auth_ref: apikey