Skip to main content
Use bulk lookup when a pipeline, alert, or case contains several IP addresses and each input needs a bounded result. Do not build a large OR query for this workflow.

Choose the enrichment

Look up service context

The request accepts between 1 and 100 addresses. Services, DNS, and OSINT accept limit_per_ip up to 25.

Handle the response

Bulk responses preserve the original input order and duplicates. Each result has one stable status: partial: true means at least one per-IP lookup has status: error. A complete upstream failure returns 503 instead of manufacturing per-IP results.
Treat not_found as a valid enrichment result, not as a request failure.

Preserve correlation

Correlate by array position rather than building a map keyed only by IP. If the input contains the same address twice, the response contains two corresponding positions.

When to use search instead

Use the normal search endpoint when you need:
  • A result page that leads the user into the search interface.
  • InfraQL filters beyond exact IP membership.
  • Pagination across an unbounded matching population.
  • Counts or aggregations over the complete result set.

Search and pagination

Learn when to use result search, count, aggregate, schema, validation, and bulk lookup.