---
title: "Resolved abuse contact (RIPE-563) for an IP / prefix / ASN"
method: GET
path: "/api/v1/network/abuse-contact/{resource}"
tags: ["Sugra NetAtlas"]
---

# Resolved abuse contact (RIPE-563) for an IP / prefix / ASN

`GET /api/v1/network/abuse-contact/{resource}`

The single resolved abuse contact for a resource via the RIPE Database abuse-contact resolver (policy RIPE-563): it walks the abuse-c -> role -> abuse-mailbox chain (and up the allocation hierarchy) and returns one email. By default also returns an independent RIPEstat abuse-contact-finder cross-check with an `agrees` flag. include_irt=true additionally surfaces the IRT / CSIRT object(s) registered for the resource (whois 'c' flag); empty when no incident-response team is registered.

## Path parameters

- `resource` string, required — IP / prefix / ASN.

## Query parameters

- `cross_check` boolean — Also return the RIPEstat abuse-contact-finder result + an `agrees` flag.
- `include_irt` boolean — Also surface the IRT/CSIRT object(s) for the resource (whois 'c' flag).

## Response `200`

Successful Response

- NetworkAbuseContactResourceData
  - `resource` string, nullable
  - `abuse_contact` AbuseContact
    - `key` string, nullable
    - `email` string, nullable
    - `suspect` boolean, nullable
    - `org_id` string, nullable
    - `source` string, nullable
  - `cross_check` CrossCheck
    - `email` string, nullable
    - `authoritative_rir` string, nullable
    - `source` string, nullable
    - `agrees` boolean, nullable
  - `_meta` AtlasMeta
    - `product` string, required — Always 'Sugra NetAtlas'.
    - `atlas_built_at` string, nullable — UTC ISO-8601 build time of the atlas snapshot that answered; null only when no connector can vouch for one.
    - `privacy_signal_version` string, required — Version of the privacy/default-route signal set.
    - `confidence` string, required — Confidence of the privacy/default-route signal: high, medium or low.
    - `accuracy` string, required — Accuracy class of the answer (e.g. public, city, country, unknown).
    - `sources` string[], required — Sugra-branded upstream families that contributed.
    - `data_time` string, nullable — When the DATA is from (UTC ISO-8601); null when nothing can vouch for it.
    - `response_time` string, required — When Sugra answered (UTC ISO-8601).
    - `partial` boolean, required — True when at least one upstream failed and the answer is incomplete.
    - `geo_confidence` string, nullable — IP-geo responses only: how trustworthy the resolved city/country is (downgrades for anycast/CDN).
    - `served_from` string, nullable — Where the answer came from (local atlas, live proxy, cache).
    - `fallback_reason` string, nullable — Why a fallback path served the answer, when one did.
    - `sources_coverage` unknown
    - `cached` boolean, nullable — True when the answer was served from the response cache (routes that cache whole answers).
    - `atlas_sha256` string, nullable — SHA-256 of the atlas snapshot (sources/coverage).
    - `endpoint_version` string, nullable — Endpoint contract version where a route declares one (sources/coverage: v1).

## Other responses

- `401` — Missing or invalid `x-api-key` header. JSON body with a stable `code` distinguishing `missing_api_key` (no header sent) from `invalid_api_key` (header sent, key not accepted); any other 401 source carries the generic `unauthorized` with its detail as `reason`. Plus `hint`. `plan` is always null on 401 - an unauthenticated request has no plan; quota exhaustion is 429, not 401.
- `422` — Validation Error
- `429` — Daily rate limit exceeded. Check `X-RateLimit-Reset` for the next window.
- `503` — Upstream source is temporarily unavailable. Retry after a short delay.

---

[API](https://skmtc.net/sugra/apis/sugra-api.md) · [All operations](https://skmtc.net/sugra/apis/sugra-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sugra/sugra-api/revisions/914af3d38c7c/schema)