Access controls
Crypto geofencing API
Geolocate the calling client — or any IP address — and get back city, region, country, and whether that country is under OFAC sanctions programs. Your application applies the policy.
GET /api/v1/geo/{ip}
# Omit the IP to geolocate the calling client
curl https://api.compliapi.com/api/v1/geo/91.218.114.206 \
-H "Authorization: Bearer $COMPLIAPI_TOKEN"import requests
resp = requests.get(
"https://api.compliapi.com/api/v1/geo/91.218.114.206",
headers={"Authorization": f"Bearer {COMPLIAPI_TOKEN}"},
)
print(resp.json())const resp = await fetch(
"https://api.compliapi.com/api/v1/geo/91.218.114.206",
{ headers: { Authorization: `Bearer ${process.env.COMPLIAPI_TOKEN}` } },
);
console.log(await resp.json());Response
{
"ip": "91.218.114.206",
"city": "Moscow",
"region": "Moscow",
"country": "RU",
"sanctioned": true,
"source_url": "..."
}Sanctioned-country flag built in
Geolocation results are checked against CompliAPI's curated list of OFAC country sanction designations — comprehensive, targeted and military.
City and region granularity
Responses include city and region, supporting rules like different handling for New York State users.
Caller or arbitrary IP
Call the endpoint with no argument to evaluate the requesting client, or pass any IP address explicitly.
One structured response
A single JSON object your access-control logic can branch on — no separate geo provider and sanctions list to join.
Which countries does OFAC sanction?
There is no single official OFAC country list — OFAC runs comprehensive embargoes against a handful of countries and regions (Cuba, Iran, North Korea, and the Crimea, Donetsk and Luhansk regions of Ukraine) plus dozens of selective programs that target sectors or officials without embargoing the country. The geofencing endpoint's sanctioned-country flag is driven by CompliAPI's curated designations across those programs, each match carrying the official program URL.
Jurisdiction rules without stitching providers together
Geofencing a crypto app usually means integrating a geolocation provider, separately working out which countries and regions your policy restricts, mapping OFAC sanctions programs to country codes yourself, and keeping that mapping current.
CompliAPI combines the lookup and the sanctions context in one request. You get the location and a sanctioned flag together — at signup, on wallet connect, or per session — and your application decides what to do with it: block, restrict features, or log.
CompliAPI returns location signals and sanctions context; it does not decide or enforce your access policy, and no IP-based location signal should be treated as infallible.
How it works
Send a request
Call /geo to evaluate the calling client's IP, or /geo/{ip} for any address your systems have observed.
CompliAPI geolocates and checks sanctions designations
The IP is geolocated to city, region and country, and the country is checked against curated OFAC sanction designations.
Apply your policy
Your application branches on the structured result — block, geo-restrict features, require review, or proceed.
What you can screen
- The calling client's IP (no argument needed)
- Any public IPv4 or IPv6 address
Where teams use it
Restricted-jurisdiction gating
Check the requesting client before a DeFi frontend lets a wallet interact with your contracts.
US state-level rules
Use the region field to apply different handling for users in New York State or other jurisdictions your policy treats separately.
Signup screening
Flag registrations from comprehensively sanctioned countries for blocking or review.
Feature availability
Serve different product experiences by country where regulatory treatment differs.
Pairing with VPN detection
Combine with the VPN endpoint to judge how much weight to give a location signal.
Scope and limitations
Geofencing signals support access-control decisions; they don't make them. Keep these boundaries in mind:
IP geolocation is probabilistic
Location derived from an IP address is an estimate. It is useful evidence, not proof of where a user is.
Users can obscure location
VPNs and proxies can shift apparent location. Pair geofencing with VPN detection when that matters to your policy.
You own the policy
CompliAPI reports where a request appears to come from and whether that country carries OFAC designations. Which jurisdictions you restrict, and how, is your organization's decision.
Curated country designations
OFAC does not publish a single official list of sanctioned countries. CompliAPI curates designations across comprehensive, targeted and military programs, with a source link for each.
Frequently asked questions
Can geofencing detect VPN usage?
VPN detection is a separate endpoint (GET /api/v1/vpn) that reports whether an IP appears to be a VPN. Many teams call both: geolocation for the jurisdiction decision, VPN detection to judge how reliable the location signal is.
Which countries are flagged as sanctioned?
Countries and regions under OFAC sanctions programs, curated by CompliAPI across comprehensive, targeted and military designations. Each flag includes a source_url so you can review the underlying program.
Can I apply state-level rules like New York?
Yes — responses include city and region alongside country, so your application can implement rules such as special handling for New York State users.
Do I have to pass an IP address?
No. Calling GET /api/v1/geo with no argument evaluates the calling client's public IP. You can also pass any public IP explicitly, for example from your own request logs.
Is IP-based geofencing enough on its own?
It depends on your obligations and risk appetite. IP signals are a widely used control but can be evaded; organizations should decide, with qualified counsel where appropriate, what combination of controls their policy requires.
Related
Access controls
VPN Detection API for Sanctions Compliance
Detect VPNs that defeat geo-blocking.
Sanctions screening
OFAC API — screen against the official SDN list
Screen crypto wallets, emails, IDs and countries against the official US Treasury OFAC SDN list, refreshed every 15 minutes.
Use case
OFAC compliance API for DeFi
Add sanctions screening, geofencing and VPN detection to a DeFi frontend: screen connecting wallets against the OFAC SDN list and apply jurisdiction rules with simple GET requests.
Use case
Sanctions screening for stablecoin payments
OFAC screening for stablecoin payment flows: check sender and recipient wallets against the SDN list and screen counterparty details before funds move.
Add geofencing to your application
Get a free API key and make your first request in minutes.
14-day free trial. No credit card required.
CompliAPI provides data and tools that support compliance workflows. It does not provide legal advice, and organizations should determine their obligations with qualified counsel.