Bulk Report

POST /v1/key/bulk-report · Back to Overview

Endpoint

POST/v1/key/bulk-report

Submit multiple reports for suspicious IP addresses in a single request. Supports up to 10,000 reports per request. Each report contributes to the community threat intelligence database and updates confidence levels.

Accepts two content types: application/json with a JSON array of reports, or multipart/form-data with a CSV file upload.

JSON request

curl -X POST "https://api.sikkerapi.com/v1/key/bulk-report" \
  -H "Authorization: Bearer sk_free_..." \
  -H "Content-Type: application/json" \
  -d '{
    "reports": [
      {"ip": "203.0.113.42", "category": "brute_force", "protocol": "ssh", "comment": "Multiple failed logins"},
      {"ip": "198.51.100.7", "category": "port_scan"},
      {"ip": "192.0.2.15", "category": 3, "protocol": "http"}
    ]
  }'

import requests

response = requests.post(
    "https://api.sikkerapi.com/v1/key/bulk-report",
    headers={
        "Authorization": "Bearer sk_free_...",
        "Content-Type": "application/json"
    },
    json={
        "reports": [
            {"ip": "203.0.113.42", "category": "brute_force", "protocol": "ssh", "comment": "Multiple failed logins"},
            {"ip": "198.51.100.7", "category": "port_scan"},
            {"ip": "192.0.2.15", "category": 3, "protocol": "http"}
        ]
    }
)

result = response.json()
print(f"Accepted: {result['accepted']}/{result['total']}")

const response = await fetch("https://api.sikkerapi.com/v1/key/bulk-report", {
  method: "POST",
  headers: {
    "Authorization": "Bearer sk_free_...",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    reports: [
      { ip: "203.0.113.42", category: "brute_force", protocol: "ssh", comment: "Multiple failed logins" },
      { ip: "198.51.100.7", category: "port_scan" },
      { ip: "192.0.2.15", category: 3, protocol: "http" }
    ]
  })
});

const result = await response.json();
console.log(`Accepted: ${result.accepted}/${result.total}`);

<?php
$data = [
    'reports' => [
        ['ip' => '203.0.113.42', 'category' => 'brute_force', 'protocol' => 'ssh', 'comment' => 'Multiple failed logins'],
        ['ip' => '198.51.100.7', 'category' => 'port_scan'],
        ['ip' => '192.0.2.15', 'category' => 3, 'protocol' => 'http']
    ]
];

$ch = curl_init("https://api.sikkerapi.com/v1/key/bulk-report");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($data),
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_free_...",
        "Content-Type: application/json"
    ]
]);

$response = curl_exec($ch);
$result = json_decode($response, true);
echo "Accepted: {$result['accepted']}/{$result['total']}\n";

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

func main() {
    body := map[string]interface{}{
        "reports": []map[string]interface{}{
            {"ip": "203.0.113.42", "category": "brute_force", "protocol": "ssh", "comment": "Multiple failed logins"},
            {"ip": "198.51.100.7", "category": "port_scan"},
            {"ip": "192.0.2.15", "category": 3, "protocol": "http"},
        },
    }

    jsonBody, _ := json.Marshal(body)
    req, _ := http.NewRequest("POST",
        "https://api.sikkerapi.com/v1/key/bulk-report",
        bytes.NewBuffer(jsonBody))

    req.Header.Set("Authorization", "Bearer sk_free_...")
    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{}
    resp, _ := client.Do(req)
    defer resp.Body.Close()

    var result map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&result)
    fmt.Printf("Accepted: %.0f/%.0f\n", result["accepted"], result["total"])
}

JSON Format

Send a JSON object with a reports array. Each element has the following fields:

Field	Type	Required	Description
ip	string	Yes	IPv4 or IPv6 address to report.
category	string \| int	Yes	Attack category. Can be a name (e.g. brute_force) or numeric ID (1-16). See the single report docs for the full category list.
protocol	string	No	Protocol involved (e.g. ssh, http). Max 32 characters.
comment	string	No	Additional context about the suspicious activity. Max 1000 characters.

JSON body

{
  "reports": [
    {
      "ip": "203.0.113.42",
      "category": "brute_force",
      "protocol": "ssh",
      "comment": "Multiple failed logins"
    },
    {
      "ip": "198.51.100.7",
      "category": "port_scan"
    }
  ]
}

CSV Upload

Upload a CSV file using multipart/form-data with the field name file. Maximum file size is 2 MB.

Column	Required	Description
1 — IP	Yes	IPv4 or IPv6 address to report.
2 — Category	Yes	Category name or numeric ID (1-16).
3 — Protocol	No	Protocol (max 32 chars).
4 — Comment	No	Comment (max 1000 chars).

A header row is automatically detected and skipped if the first field does not look like an IP address. Both comma and semicolon delimiters are supported (auto-detected). Quoted fields are handled.

CSV file (reports.csv)

IP,Category,Protocol,Comment
203.0.113.42,brute_force,ssh,Multiple failed logins
198.51.100.7,port_scan,,
192.0.2.15,3,http,Exploit attempts

Upload CSV

curl -X POST "https://api.sikkerapi.com/v1/key/bulk-report" \
  -H "Authorization: Bearer sk_free_..." \
  -F "[email protected]"

import requests

with open("reports.csv", "rb") as f:
    response = requests.post(
        "https://api.sikkerapi.com/v1/key/bulk-report",
        headers={"Authorization": "Bearer sk_free_..."},
        files={"file": ("reports.csv", f, "text/csv")}
    )

result = response.json()
print(f"Accepted: {result['accepted']}/{result['total']}")

const formData = new FormData();
formData.append("file", csvFile); // File object from input or Blob

const response = await fetch("https://api.sikkerapi.com/v1/key/bulk-report", {
  method: "POST",
  headers: {
    "Authorization": "Bearer sk_free_..."
  },
  body: formData
});

const result = await response.json();
console.log(`Accepted: ${result.accepted}/${result.total}`);

<?php
$ch = curl_init("https://api.sikkerapi.com/v1/key/bulk-report");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => [
        'file' => new CURLFile('reports.csv', 'text/csv')
    ],
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer sk_free_..."
    ]
]);

$response = curl_exec($ch);
$result = json_decode($response, true);
echo "Accepted: {$result['accepted']}/{$result['total']}\n";

Response

The response includes a summary of accepted and rejected reports. Invalid rows are listed individually in the errors array with row number, IP, and error message.

Field	Type	Description
total	int	Total number of rows in the request.
accepted	int	Number of reports successfully submitted.
rejected	int	Number of reports that failed validation.
errors	array	Per-row errors. Each entry has row, ip, and error.

200 - All accepted

{
  "total": 3,
  "accepted": 3,
  "rejected": 0,
  "errors": []
}

200 - Partial success

{
  "total": 3,
  "accepted": 2,
  "rejected": 1,
  "errors": [
    {
      "row": 2,
      "ip": "bad-ip",
      "error": "Invalid IP address"
    }
  ]
}

Error Codes

Top-level errors return a JSON object with an error field. Per-row validation errors are returned inside the errors array of a 200 response.

Status	Meaning
200	Batch processed. Check accepted and errors for per-row results.
400	Invalid request (empty body, exceeds 10,000 rows, bad JSON, empty CSV, etc.).
401	Missing or invalid API key.
403	API key is disabled or expired.
415	Unsupported content type. Use application/json or multipart/form-data.
429	Rate limit exceeded. Check Retry-After header.
503	Upstream service unavailable.

400 - Too many rows

{
  "error": "Maximum 10,000 reports per request"
}

415 - Wrong content type

{
  "error": "Unsupported content type. Use application/json or multipart/form-data"
}

429 - Rate limited

{
  "error": "Rate limit exceeded"
}

Limits

Limit	Value
Max reports per request	10,000
Max CSV file size	2 MB
Max request body size	12 MB
Max protocol length	32 characters
Max comment length	1,000 characters
Duplicate IPs in batch	Rejected (first occurrence wins)

Report submissions share the daily report quota with the single /v1/key/report endpoint. Each accepted row in a bulk request counts as one report against your quota.

Tier	Reports/Day
Free	1,000
Basic	7,000
Small Business	14,000
Medium Business	30,000
Large Business	100,000

Rate limit headers on 429 responses:

Headers

HTTP/1.1 429 Too Many Requests
Retry-After: 5
Content-Type: application/json

Get started — Submit up to 10,000 reports per request with a free API key. Free tier includes 1,000 reports per day. Create free API key →