riposte-marketplace/integrations/ipinfo/manifest.yaml

id: ipinfo
name: IPinfo
version: 1.1.0
description: "IPinfo — IP address enrichment. Lite API (all plans, unlimited): ASN / AS name / AS domain / country / continent. Core API (paid Core plan): geolocation, network details and privacy flags (hosting, mobile, anycast, satellite)."
changelog: "1.1.0 — Lite API support for accounts on the free/Lite plan: lite_lookup_ip, lite_lookup_me and lite_batch (POST /batch/lite, chunked at 1000 IPs). test_connection now calls /lite/me, which every plan can reach, so the Test button no longer fails on Lite-only tokens. Core commands renamed in their description to state the Core plan requirement. 1.0.1 — Re-publish to regenerate form-based command scripts (fixes 'script not found' on install). 1.0.0 — Initial release: IP lookup, single-field lookup, own IP, batch, and connectivity test."
category: enrichment

config_schema:
  properties:
    base_url:
      type: string
      description: "IPinfo API base URL (shared by the Lite and Core endpoints)"
      default: https://api.ipinfo.io
    token:
      type: string
      description: IPinfo API access token (Account → Token)
      x-soar-sensitive: true
  required:
    - token

# IPinfo authenticates with the access token as the `token` query parameter.
auth:
  - id: apikey
    type: api_key
    in: query
    name: token
    value_template: "{{secret}}"
    secret_field: token

commands:
  # ── Lite API — available on every plan, no daily/monthly quota ─────────────
  - id: lite_lookup_ip
    name: ipinfo-lite-lookup-ip
    description: "Lite enrichment for an IP — ASN, AS name, AS domain, country and continent. Works on every plan, including free/Lite."
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IPv4 or IPv6 address" }
      required: [ip]
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lite/{ip}
      auth_ref: apikey

  - id: lite_lookup_me
    name: ipinfo-lite-lookup-me
    description: "Lite details for the IP address making the request (ASN, country, continent)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lite/me
      auth_ref: apikey

  # Code-first: POST /batch/lite takes a raw JSON array body, which the
  # form-based generator (object body) cannot produce. See scripts/lite_batch.py.
  - id: lite_batch
    name: ipinfo-lite-batch
    description: "Lite lookup for many IPs in one call. Chunked at the API limit of 1000 IPs per request; returns one object keyed by IP."
    risk: read
    inputs_schema:
      properties:
        ips: { type: string, description: "Comma-separated IP addresses, e.g. '8.8.8.8,1.1.1.1'" }
      required: [ips]
    outputs_schema: { properties: {} }

  # ── Core API — requires a paid Core plan (403 on Lite/free tokens) ─────────
  - id: lookup_ip
    name: ipinfo-lookup-ip
    description: "Core plan required. Full enrichment for an IP — geolocation, ASN/network, and privacy/network flags."
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IPv4 or IPv6 address" }
      required: [ip]
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lookup/{ip}
      auth_ref: apikey

  - id: lookup_field
    name: ipinfo-lookup-field
    description: "Core plan required. A single field for an IP (e.g. city, country, hostname, as)."
    risk: read
    inputs_schema:
      properties:
        ip: { type: string, description: "IP address" }
        field: { type: string, description: "Field name, e.g. city, country, hostname, as" }
      required: [ip, field]
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lookup/{ip}/{field}
      auth_ref: apikey

  - id: lookup_me
    name: ipinfo-lookup-me
    description: "Core plan required. Details for the IP address making the request."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lookup/me
      auth_ref: apikey

  # Code-first: the batch endpoint takes a raw JSON array body, which the
  # form-based generator (object body) cannot produce. See scripts/batch.py.
  - id: batch
    name: ipinfo-batch
    description: "Core plan required. Look up multiple IPs (or IP/field paths) in a single request."
    risk: read
    inputs_schema:
      properties:
        ips: { type: string, description: "Comma-separated IPs or lookup paths, e.g. '8.8.8.8,1.1.1.1,8.8.4.4/country'" }
      required: [ips]
    outputs_schema: { properties: {} }

  # Uses the Lite endpoint on purpose: it validates the token on every plan,
  # whereas /lookup/me returns 403 for Lite-only accounts.
  - id: test_connection
    name: ipinfo-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }
    request:
      method: GET
      path: /lite/me
      auth_ref: apikey