---
name: greynoise-community-api-ingestion
description: "How to get GreyNoise Community API data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Query a GreyNoise Community IP into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/greynoise-community-api
Provider: https://docs.greynoise.io/docs/using-the-greynoise-community-api
Checked against the provider's documentation: 2026-11-01

## Access
- No account or key for up to 10 IPv4 lookups per day.
- A free account using a business email supplies an API key and raises the combined Community API and Visualizer allowance to 50 searches per week.

## Request
```bash
curl 'https://api.greynoise.io/v3/community/8.8.8.8'
```

## Format
JSON for one IPv4 address with noise and RIOT booleans plus classification, organization name, last-seen date, link and message when available.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""GreyNoise Community lookup for one IPv4 address -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://api.greynoise.io/v3/community/8.8.8.8"
r = requests.get(URL, timeout=60)
if r.status_code not in (200, 404):
    r.raise_for_status()
payload = r.json()
df = pd.DataFrame([payload])
df["last_seen"] = pd.to_datetime(df.get("last_seen"), errors="coerce", utc=True)
df.to_parquet("greynoise_community.parquet", index=False)
print(payload["ip"], "noise", payload.get("noise"), "riot", payload.get("riot"), payload.get("message"))
```
Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 8.8.8.8 noise False riot False IP not observed scanning the internet.

## Limits
- Rate limit: 10 IP lookups per day without authentication.
- Free-account limit: 50 searches per week combined between the Community API and Visualizer.
- Only one valid routable IPv4 address is accepted per request.

## Quirks
- A 404 response is a structured negative observation, so retain its JSON instead of treating it as a failed ingestion.
- noise means the address was observed scanning the Internet in the last 90 days; it is not by itself a malicious-intent finding.
- Free responses omit much of the context available in paid GreyNoise products, and fields such as classification or last_seen may be absent.

## Terms and attribution
- Free-product use is licensed for internal business or non-commercial purposes and is revocable.
- The provider terms prohibit redistribution, unauthorized derived products, and using GreyNoise data to train or improve AI systems.
- Terms page: https://www.greynoise.io/terms

## Sources
- https://docs.greynoise.io/docs/using-the-greynoise-community-api.md: "Available to unauthenticated users with a limited number of lookups per day"
- https://docs.greynoise.io/docs/using-the-greynoise-community-api.md: "Currently, community / free-level accounts are able to do 50 searches per week."
- https://docs.greynoise.io/reference/getcommunityip.md: "The IP address submitted is not a valid routable IPv4 address."
- https://www.greynoise.io/terms: "such use is limited to your internal business purposes or noncommercial purposes such as academic research, if applicable."

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.