API Reference

Everything you need to integrate Analytico into your application.

Introduction

The Analytico API is a RESTful interface for detecting click fraud, invalid traffic, and bot activity. All requests use JSON and require an API key.

Base URL:

https://analytico.space/api

All API responses are JSON. Successful responses return HTTP 200. Errors return 4xx with an error field.

Authentication

Every request requires an API key passed either in the JSON body or as the X-API-Key header.

# Via header (recommended)
curl -H "X-API-Key: as_YOUR_KEY" \
     -H "Content-Type: application/json" \
     -d '{"ip":"1.2.3.4"}' \
     https://analytico.space/api/check.php

# Via body
curl -X POST https://analytico.space/api/check.php \
     -H "Content-Type: application/json" \
     -d '{"api_key":"as_YOUR_KEY","ip":"1.2.3.4"}'

Get your API key from Dashboard → API Keys.

Quick Start

Three steps to protect your traffic:

  1. Create an API key in your dashboard.
  2. Call POST /api/check.php with the visitor's IP on every request.
  3. Block or redirect traffic based on the verdict field in the response.
curl -X POST https://analytico.space/api/check.php \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "as_YOUR_KEY",
    "ip": "1.2.3.4",
    "user_agent": "Mozilla/5.0 ...",
    "url": "https://yoursite.com/landing"
  }'

Response:

{
  "verdict": "clean",
  "fraud_score": 12,
  "quality_score": 88,
  "is_bot": false,
  "is_vpn": false,
  "country_code": "US",
  "ip_type": "residential"
}

POST /v1/check

Analyze a single IP address and return a fraud verdict. This is the primary endpoint.

POSThttps://analytico.space/api/check.php

Request body

FieldTypeRequiredDescription
api_keystringYes*Your API key (or use X-API-Key header)
ipstringYesIPv4 or IPv6 address to check
user_agentstringNoBrowser User-Agent string
urlstringNoLanding page URL
referrerstringNoHTTP referrer
clickidstringNoYour click ID for postback tracking
subidstringNoSub-affiliate ID

Response fields

FieldTypeDescription
verdictstringclean, suspicious, or blocked
fraud_scoreinteger0–100. Higher = more fraudulent.
quality_scoreinteger0–100. Higher = better quality traffic.
is_botbooleanTrue if automated/bot traffic detected.
is_vpnbooleanTrue if VPN or proxy detected.
is_torbooleanTrue if Tor exit node.
is_datacenterbooleanTrue if datacenter/hosting IP.
country_codestringISO 3166-1 alpha-2 country code.
ip_typestringresidential / mobile / datacenter / vpn / proxy / tor
threat_typesarrayList of detected threat signals.

POST /v1/batch

Check up to 100 IP addresses in a single request. Ideal for log analysis, bulk verification, or pre-screening traffic lists.

POSThttps://analytico.space/api/batch.php

Request body

curl -X POST https://analytico.space/api/batch.php \
  -H "X-API-Key: as_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "ips": [
      "1.2.3.4",
      "185.220.101.42",
      "8.8.8.8"
    ]
  }'

Response

{
  "results": [
    {
      "ip": "1.2.3.4",
      "verdict": "clean",
      "fraud_score": 5,
      "quality_score": 95,
      "is_bot": false
    },
    {
      "ip": "185.220.101.42",
      "verdict": "blocked",
      "fraud_score": 97,
      "quality_score": 3,
      "is_bot": true
    }
  ],
  "total": 3,
  "blocked": 1,
  "clean": 2,
  "processing_ms": 142
}

Rate limit: 100 IPs per request, up to 10 batch requests per minute on Pro. Enterprise has no batch limit.

GET /v1/keys

List all active API keys for your account. Useful for programmatic key management and rotation.

GEThttps://analytico.space/api/keys.php
curl https://analytico.space/api/keys.php \
  -H "X-API-Key: as_YOUR_KEY"

Response

{
  "keys": [
    {
      "id": 1,
      "name": "Production key",
      "prefix": "as_prod_****",
      "created_at": "2024-01-15T10:30:00Z",
      "last_used_at": "2024-03-01T14:22:11Z",
      "is_active": true
    }
  ],
  "total": 1
}

Verdicts

VerdictFraud ScoreMeaningRecommended action
clean0–29Legitimate human trafficAllow through
suspicious30–64Uncertain — may be bot, VPN, or low-quality trafficAllow but flag, or show CAPTCHA
blocked65–100High-confidence fraud, bot, or invalid trafficBlock or redirect to /404

Error Codes

HTTP CodeErrorDescription
400missing_ipThe ip field is required.
400invalid_ipThe IP address format is invalid.
401unauthorizedAPI key missing, invalid, or inactive.
429rate_limitedMonthly check limit reached. Upgrade your plan.
500internal_errorServer error. Retry after a few seconds.

PHP SDK

Drop-in PHP class — no Composer required.

class AnalyticoClient {
    private string $apiKey;
    private string $baseUrl = 'https://analytico.space/api';

    public function __construct(string $apiKey) {
        $this->apiKey = $apiKey;
    }

    public function check(string $ip, array $opts = []): array {
        $payload = array_merge(['ip' => $ip], $opts);
        $ch = curl_init($this->baseUrl . '/check.php');
        curl_setopt_array($ch, [
            CURLOPT_POST           => true,
            CURLOPT_POSTFIELDS     => json_encode($payload),
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER     => [
                'Content-Type: application/json',
                'X-API-Key: ' . $this->apiKey,
            ],
            CURLOPT_TIMEOUT        => 5,
        ]);
        $resp = json_decode(curl_exec($ch), true);
        curl_close($ch);
        return $resp ?? [];
    }

    public function batch(array $ips): array {
        $ch = curl_init($this->baseUrl . '/batch.php');
        curl_setopt_array($ch, [
            CURLOPT_POST           => true,
            CURLOPT_POSTFIELDS     => json_encode(['ips' => $ips]),
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER     => [
                'Content-Type: application/json',
                'X-API-Key: ' . $this->apiKey,
            ],
            CURLOPT_TIMEOUT        => 15,
        ]);
        $resp = json_decode(curl_exec($ch), true);
        curl_close($ch);
        return $resp ?? [];
    }
}

# Usage
$client = new AnalyticoClient('as_YOUR_KEY');
$result = $client->check($_SERVER['REMOTE_ADDR']);
if ($result['verdict'] === 'blocked') {
    http_response_code(403); exit;
}

Python

Pure Python — uses only the standard library urllib. No pip install needed.

import urllib.request, json

class AnalyticoClient:
    def __init__(self, api_key: str):
        self.api_key = api_key
        self.base_url = 'https://analytico.space/api'

    def _post(self, endpoint: str, payload: dict) -> dict:
        data = json.dumps(payload).encode('utf-8')
        req  = urllib.request.Request(
            self.base_url + endpoint,
            data=data,
            headers={
                'Content-Type': 'application/json',
                'X-API-Key': self.api_key,
            }
        )
        with urllib.request.urlopen(req, timeout=5) as r:
            return json.loads(r.read())

    def check(self, ip: str, **kwargs) -> dict:
        """Check a single IP address."""
        return self._post('/check.php', {'ip': ip, **kwargs})

    def batch(self, ips: list) -> dict:
        """Check up to 100 IPs in one request."""
        return self._post('/batch.php', {'ips': ips})

# Usage
client = AnalyticoClient('as_YOUR_KEY')

# Single check
result = client.check('1.2.3.4', user_agent='Mozilla/5.0')
print(result['verdict'], result['fraud_score'])

# Batch check
results = client.batch(['1.2.3.4', '185.220.101.42', '8.8.8.8'])
for r in results['results']:
    if r['verdict'] == 'blocked':
        print(f"Block: {r['ip']}")

Node.js

Works with Node.js 18+ using the built-in fetch API. Zero dependencies.

class AnalyticoClient {
  constructor(apiKey) {
    this.apiKey  = apiKey;
    this.baseUrl = 'https://analytico.space/api';
  }

  async #post(endpoint, body) {
    const res = await fetch(this.baseUrl + endpoint, {
      method:  'POST',
      headers: {
        'Content-Type': 'application/json',
        'X-API-Key':     this.apiKey,
      },
      body: JSON.stringify(body),
      signal: AbortSignal.timeout(5000),
    });
    if (!res.ok) throw new Error(`Analytico API error: ${res.status}`);
    return res.json();
  }

  async check(ip, opts = {}) {
    /** Check a single IP address. */
    return this.#post('/check.php', { ip, ...opts });
  }

  async batch(ips) {
    /** Check up to 100 IPs in one call. */
    return this.#post('/batch.php', { ips });
  }
}

// Usage (ESM / CommonJS both work)
const client = new AnalyticoClient('as_YOUR_KEY');

// Single IP
const result = await client.check('1.2.3.4');
if (result.verdict === 'blocked') {
  res.status(403).send('Access denied');
}

// Batch
const { results } = await client.batch(['1.2.3.4', '5.6.7.8']);
results.forEach(r => console.log(r.ip, r.verdict));

Postbacks

Postbacks let Analytico fire tracking URLs whenever a traffic event occurs. Ideal for affiliate networks, DSPs, and ad tracking platforms.

Macros

MacroDescriptionExample
{ip}Visitor IP address185.220.101.42
{verdict}clean / suspicious / blockedblocked
{fraud_score}Fraud score 0–10092
{quality_score}Quality score 0–1008
{country_code}ISO country codeNL
{clickid}Your click ID (from API request)abc123
{subid}Sub-affiliate IDpub456
{payout}Campaign CPC payout0.450
{request_id}Unique check IDreq_4f8a2c
{timestamp}Unix timestamp1735689600
{is_vpn}1 if VPN, 0 otherwise1
{is_bot}1 if bot, 0 otherwise0

Example URLs

# Affiliate network
https://network.com/postback?click={clickid}&status={verdict}&score={fraud_score}

# DSP pixel
https://track.dsp.com/conv?cid={clickid}&sub={subid}&payout={payout}&q={quality_score}

# Internal analytics
https://analytics.yoursite.com/event?ip={ip}&event={verdict}&ts={timestamp}