Nimbostratus
MVPSee the link below as this is good question but yes API is the way to go.
MVPThink the poster also needs to address the time stamp storage. I checked the API for datagroups, and we dont support a 'description' field where an epoch timestamp would be ideal.
https://clouddocs.f5.com/api/icontrol-rest/APIRef_tm_ltm_data-group_internal.html
Instead, we can use key / value pairs. Store the IP address as NAME and the epoch time in DATA. Using this approach, it would be easy via iRule or whatever to lookup a source IP against the datagroup, retrieve the last acess time in epoch format, and either perform a comparison or update. Of course one could also programmatically iterate through the datagroup list and purge out old entries.