What this endpoint does

This endpoint returns only the HTTP headers (no body) for an IP address risk list, providing a lightweight way to check whether the risk list has changed without downloading the full file. The primary use case is polling for updates: store the ETag value from a previous response and compare it against subsequent HEAD requests to detect when the list has been refreshed. This is the companion to the IP Risk List GET endpoint — use HEAD for change detection and GET only when the ETag indicates new content. The same list and format parameters apply, so the ETag corresponds to the specific risk rule and format combination you would download.

Response data

The response has no body. The key header is ETag, which contains an MD5 hash of the risk list file content (or SHA-256 if the risk list has been overridden by a user-uploaded custom list). Compare this value across requests to detect changes — a different ETag means the risk list has been updated and should be re-downloaded via the GET endpoint. The response also includes standard HTTP headers like Content-Type and cache-control directives.