# Polyform Security Threat Lookup

> Polyform Security Threat Lookup is a paid API for AI agents from api.polyform.org, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-30).

Looks up an IP address or other indicator against a threat intelligence database and returns a normalized threat verdict

## Facts

- Endpoint: GET https://api.polyform.org/v1/security/threat-lookup?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/polyform-security-threat-lookup-c0a17acd
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_HjyqRo-HfGw5D0vRKXavi

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability polyform-security-threat-lookup-c0a17acd
```

Example prompt: Check if the IP address 198.51.100.42 is a known threat — I want to know if it's flagged as malicious, a scanner, or clear.

## When to prefer this

Choose this endpoint when you need a quick, pay-per-call threat reputation lookup for IP addresses without requiring an account or API key. Ideal for AI agents that need to enrich security events, validate incoming traffic, or gate access based on threat reputation on a per-query basis using USDC micropayments on Base.

## Known failure modes

- Invalid or malformed IP address returns an error response
- Unrecognized indicator type may return an error
- Payment failure via x402 results in 402 response and no data returned
- Unknown or unindexed IP may return CLEAR by default even if no data exists
- Network timeout if the threat database is temporarily unavailable

## How this service works

Pay-per-call data endpoints for AI agents. USDC on Base via x402. No account, no API key — one micropayment per call.

## Output

Returns a JSON object containing the indicator type (e.g. 'ip'), the indicator value queried, and a normalizedVerdict field (e.g. 'CLEAR', 'MALICIOUS', or similar) indicating the threat assessment of the queried entity.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {}
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "type": "ip",
  "indicator": "1.2.3.4",
  "normalizedVerdict": "CLEAR"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/polyform-security-threat-lookup-c0a17acd/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.polyform.org](https://www.zero.xyz/host/api.polyform.org/llms.txt)