Changelog

Dates are US Pacific time. A change to the API itself, rather than to these docs, can go live up to a few days after its date.

2026-10-29

Secure web gateway networks answer unknown. An address on a network that Zscaler, Netskope or Cisco Umbrella runs itself, which no range or observation matches, now answers unknown with a risk_score of 0 instead of hosting. See Tiers.
Residential proxy scores follow recency. On every plan, a residential proxy hit’s risk_score now follows how recently we saw the address: current 95–100, recent 75–85, stale 45–60, frozen 25–35. On a mobile carrier, satellite network or secure web gateway that we list, it scores at most 60 and carries the new SHARED_ADDRESS_NETWORK reason; see Residential proxy hits.
New guide: point-in-time lookups. Point-in-time lookups covers as_of: the archive, the answer and the errors it can return.
OpenAPI spec. The spec now documents GET /api/v1/asn/{asn} (Pro and up) and GET /api/v1/export/dataset, gives the server address and the apiKey query parameter, and says that infra_type does not mark mobile networks.
Tiers page corrected. It no longer promises metered lookups beyond the monthly quota. A key with no credits left gets 403 until it is topped up or its plan renews: the 403 row in Error handling now says so, and that page’s 429 example shows the body and headers the API sends.

Point-in-time lookups. On Business and Enterprise, add as_of=YYYY-MM-DD to a single-IP lookup, in either request form, for our answer for that IP on a past UTC day, from a daily archive kept since 2026-07-31. Other plans get 403.

MMDB flags and typed Parquet. The MMDB records now carry the API’s is_hosting, is_cdn and is_residential_proxy flags beside the ones they already had. In the bulk Parquet files, confidence and hits_days_pct are now doubles and first_seen and last_seen UTC timestamps instead of strings, so a table that declares them as strings has to change; see Bulk Exports.
Batch charges in the response. POST /api/v1/ip/batch now returns credits_charged, the credits charged for the call. A batch costs one credit per distinct IP looked up, so the same address written two ways is now charged once; rows with error stay free.
30-day and 90-day points files. Each daily build now also writes 30-day and 90-day cuts of the residential points table, beside the 1-day and 7-day ones, for Business and Enterprise.

1-day and 7-day points files. Each daily build now also writes the residential points rows whose last_seen is no earlier than 1 or 7 days before the build’s data_as_of, as zstd CSV and Parquet files, for Business and Enterprise; see Which window file to use.
Starter gets the hosting-to-proxy relabel. On Starter, as on Pro and up, a hosting address can now come back as proxy because of its ASN’s abuse profile, with asn_abuse_promoted set to true. The abuse breakdown itself stays Pro and up.

Higher rate limits on Starter and Pro. Starter’s limit rose from 30 to 120 requests a minute and Pro’s from 100 to 150, so no plan’s limit is below the plan beneath it. The other plans are unchanged; see Authentication.

The ?ipAddress= query form works. GET /api/v1?apiKey=YOUR_API_KEY&ipAddress={ip}, the form every WhoisXML API uses, now reaches the API through the public host, and these docs use it again. The path form, GET /api/v1/ip/{ip}, still returns the same response.

Confidence and freshness fields start at Pro. On Intro and Starter, confidence and the freshness fields (first_seen, last_seen, observation_count, hits_days_pct, providers_num, confidence_decay, freshness_class) now return null, and Starter returns provider as null on a residential proxy label, as the Tiers table says. risk_score and the is_* flags stay on every plan, and lookups made without a key now return provider and confidence as null.
vpn_concentrator retired. We no longer assign vpn_concentrator, which sets is_vpn: a detection that would have carried it now returns the advisory suspected_vpn, which sets no is_* flag. Addresses labelled before this change can still return vpn_concentrator.