> ## Documentation Index > Fetch the complete documentation index at: https://vpn-docs.wxapros.com/llms.txt > Use this file to discover all available pages before exploring further. # Shadow VPN lookup > Remote-access infrastructure assets on an IP. ## OpenAPI ````yaml GET /api/v1/shadow_vpn/lookup/{ip} openapi: 3.1.0 info: title: WXA VPN IP Intelligence API description: >- Real-time and bulk IP intelligence for VPN, proxy, Tor, relay, hosting, CDN, and residential proxy detection. **Authentication:** Customer-facing requests are authenticated by the wxaintel-platform gateway (`wxaintel.wxapros.com/api/v1/vpn/...`) which validates the `Authorization: Bearer` header or `?apiKey=` query param, enforces tier and quota, then forwards to this backend with a shared `X-Internal-Key` + `X-Tier`. See CONTRACT.md. **Tiers:** free, starter, pro, scale, business, enterprise. Pro+ adds residential proxy attribution, confidence/freshness, and CSV export. Business+ adds MMDB and Parquet bulk downloads. Enterprise adds NetFlow protocol attribution. contact: name: WXA VPN Support url: https://www.whoisxmlapi.com/ email: support@whoisxmlapi.com version: 1.0.0 servers: [] security: [] paths: /api/v1/shadow_vpn/lookup/{ip}: get: summary: Shadow Vpn Lookup description: >- Shadow VPN Use — per-IP lookup (Plan 1b multi-asset response). Returns `{ip, assets: [...]}` where each asset is a RAI record (per port / protocol_family) with its attribution claims. 404 if no matching assets exist for the IP. 400 if the IP string is malformed. operationId: shadow_vpn_lookup_api_v1_shadow_vpn_lookup__ip__get parameters: - name: ip in: path required: true schema: type: string title: Ip - name: min_confidence in: query required: false schema: type: number maximum: 1 minimum: 0 description: >- Filter attributions: only those with signal_confidence >= this value are returned. default: 0 title: Min Confidence description: >- Filter attributions: only those with signal_confidence >= this value are returned. - name: include in: query required: false schema: anyOf: - type: string - type: 'null' description: >- Comma-separated extra blocks to include. 'cves' attaches per-asset CVE detail. title: Include description: >- Comma-separated extra blocks to include. 'cves' attaches per-asset CVE detail. - name: min_severity in: query required: false schema: anyOf: - type: string - type: 'null' description: >- When include=cves, only return findings >= this rating (low|medium|high|critical). title: Min Severity description: >- When include=cves, only return findings >= this rating (low|medium|high|critical). - name: kev_only in: query required: false schema: type: boolean description: When include=cves, only return CVEs flagged in CISA KEV. default: false title: Kev Only description: When include=cves, only return CVEs flagged in CISA KEV. - name: cve_min_confidence in: query required: false schema: anyOf: - type: string - type: 'null' description: >- When include=cves, only return findings whose detection_confidence is >= this rank (low|medium|high). title: Cve Min Confidence description: >- When include=cves, only return findings whose detection_confidence is >= this rank (low|medium|high). - name: X-Internal-Key in: header required: false schema: type: string default: '' title: X-Internal-Key - name: X-Tier in: header required: false schema: type: string default: '' title: X-Tier - name: X-User-Id in: header required: false schema: type: string default: '' title: X-User-Id - name: X-Quota-Used in: header required: false schema: type: string default: '' title: X-Quota-Used responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ShadowVPNLookupOut' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: ShadowVPNLookupOut: properties: ip: type: string title: Ip assets: items: $ref: '#/components/schemas/ShadowVPNAssetOut' type: array title: Assets type: object required: - ip - assets title: ShadowVPNLookupOut HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError ShadowVPNAssetOut: properties: port: type: integer title: Port protocol_family: type: string title: Protocol Family vendor: anyOf: - type: string - type: 'null' title: Vendor product: anyOf: - type: string - type: 'null' title: Product version_band: anyOf: - type: string - type: 'null' title: Version Band version_precision: anyOf: - type: string - type: 'null' title: Version Precision exact_version: anyOf: - type: string - type: 'null' title: Exact Version confidence_band: type: string title: Confidence Band evidence_sources: items: type: string type: array title: Evidence Sources first_seen: type: string title: First Seen last_seen: type: string title: Last Seen attributions: items: $ref: '#/components/schemas/ShadowVPNAttributionOut' type: array title: Attributions cve_summary: anyOf: - $ref: '#/components/schemas/CveSummaryOut' - type: 'null' cves: anyOf: - items: $ref: '#/components/schemas/CveFindingOut' type: array - type: 'null' title: Cves type: object required: - port - protocol_family - vendor - product - version_band - version_precision - exact_version - confidence_band - evidence_sources - first_seen - last_seen - attributions title: ShadowVPNAssetOut ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError ShadowVPNAttributionOut: properties: org_name: type: string title: Org Name signal_source: type: string title: Signal Source signal_confidence: type: number title: Signal Confidence observed_at: type: string title: Observed At type: object required: - org_name - signal_source - signal_confidence - observed_at title: ShadowVPNAttributionOut CveSummaryOut: properties: total_count: type: integer title: Total Count max_severity_score: anyOf: - type: number - type: 'null' title: Max Severity Score max_severity_rating: anyOf: - type: string - type: 'null' title: Max Severity Rating kev_count: type: integer title: Kev Count eol_status: anyOf: - type: string - type: 'null' title: Eol Status last_computed_at: anyOf: - type: string - type: 'null' title: Last Computed At type: object required: - total_count - kev_count title: CveSummaryOut CveFindingOut: properties: cve_id: type: string title: Cve Id severity_score: anyOf: - type: number - type: 'null' title: Severity Score severity_rating: anyOf: - type: string - type: 'null' title: Severity Rating cvss_version: anyOf: - type: string - type: 'null' title: Cvss Version kev_added_at: anyOf: - type: string - type: 'null' title: Kev Added At epss_score: anyOf: - type: number - type: 'null' title: Epss Score epss_percentile: anyOf: - type: number - type: 'null' title: Epss Percentile euvd_id: anyOf: - type: string - type: 'null' title: Euvd Id jvn_id: anyOf: - type: string - type: 'null' title: Jvn Id matched_via: anyOf: - type: string - type: 'null' title: Matched Via detection_confidence: type: string title: Detection Confidence source: type: string title: Source type: object required: - cve_id - detection_confidence - source title: CveFindingOut ````