Maybe this could be done by a IP/DNS blacklist on your API side. So you maintain a list on your "exit node" so that everyone who requests your data needs to be

Maybe this could be done by a IP/DNS blacklist on your API side. So you maintain a list on your "exit node" so that everyone who requests your data needs to be "a good guy". If this part would be done by the requester it could be spoofed easily, so it had to happen on the exit point.