> ## Documentation Index
> Fetch the complete documentation index at: https://vpn-docs.wxapros.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Changes to the API and these docs that affect what you send or get back, newest first.

Dates are US Pacific time. A change to the API itself, rather than to these
docs, can go live up to a few days after its date.

## 2026-10-29

* **Secure web gateway networks answer `unknown`.** An address on a network that
  Zscaler, Netskope or Cisco Umbrella runs itself, which no range or observation
  matches, now answers `unknown` with a `risk_score` of 0 instead of `hosting`.
  See [Tiers](https://vpn-docs.wxapros.com/tiers.md#fields-populated-by-evidence-class).
* **Residential proxy scores follow recency.** On every plan, a residential
  proxy hit's `risk_score` now follows how recently we saw the address: current
  95–100, recent 75–85, stale 45–60, frozen 25–35. On a mobile carrier,
  satellite network or secure web gateway that we list, it scores at most 60
  and carries the new `SHARED_ADDRESS_NETWORK` reason; see
  [Residential proxy hits](https://vpn-docs.wxapros.com/guides/lookups.md#residential-proxy-hits).
* **New guide: point-in-time lookups.**
  [Point-in-time lookups](https://vpn-docs.wxapros.com/guides/point-in-time.md) covers `as_of`: the archive,
  the answer and the errors it can return.
* **OpenAPI spec.** The spec now documents
  [`GET /api/v1/asn/{asn}`](https://vpn-docs.wxapros.com/api-reference/asn-reputation) (Pro and up) and
  [`GET /api/v1/export/dataset`](https://vpn-docs.wxapros.com/api-reference/export-dataset), gives the
  server address and the `apiKey` query parameter, and says that `infra_type`
  does not mark mobile networks.
* **Tiers page corrected.** It no longer promises metered lookups beyond the
  monthly quota. A key with no credits left gets `403` until it is topped up or
  its plan renews: the `403` row in [Error handling](https://vpn-docs.wxapros.com/guides/error-handling.md) now
  says so, and that page's `429` example shows the body and headers the API
  sends.

## 2026-10-25

* **Point-in-time lookups.** On Business and Enterprise, add
  `as_of=YYYY-MM-DD` to a single-IP lookup, in either request form, for our
  answer for that IP on a past UTC day, from a daily archive kept since
  2026-07-31. Other plans get `403`.

## 2026-10-23

* **MMDB flags and typed Parquet.** The MMDB records now carry the API's
  `is_hosting`, `is_cdn` and `is_residential_proxy` flags beside the ones they
  already had. In the bulk Parquet files, `confidence` and `hits_days_pct` are
  now doubles and `first_seen` and `last_seen` UTC timestamps instead of
  strings, so a table that declares them as strings has to change; see
  [Bulk Exports](https://vpn-docs.wxapros.com/guides/bulk-export.md#parquet-to-snowflake).
* **Batch charges in the response.** `POST /api/v1/ip/batch` now returns
  `credits_charged`, the credits charged for the call. A batch costs one credit
  per distinct IP looked up, so the same address written two ways is now
  charged once; rows with `error` stay free.
* **30-day and 90-day points files.** Each daily build now also writes 30-day
  and 90-day cuts of the residential points table, beside the 1-day and 7-day
  ones, for Business and Enterprise.

## 2026-10-22

* **1-day and 7-day points files.** Each daily build now also writes the
  residential points rows whose `last_seen` is no earlier than 1 or 7 days
  before the build's `data_as_of`, as zstd CSV and Parquet files, for Business
  and Enterprise; see
  [Which window file to use](https://vpn-docs.wxapros.com/guides/bulk-export.md#which-window-file-to-use).
* **Starter gets the hosting-to-proxy relabel.** On Starter, as on Pro and up,
  a hosting address can now come back as `proxy` because of its ASN's abuse
  profile, with `asn_abuse_promoted` set to `true`. The abuse breakdown itself
  stays Pro and up.

## 2026-10-20

* **Higher rate limits on Starter and Pro.** Starter's limit rose from 30 to 120
  requests a minute and Pro's from 100 to 150, so no plan's limit is below the
  plan beneath it. The other plans are unchanged; see
  [Authentication](https://vpn-docs.wxapros.com/authentication.md#tiers-and-rate-limits).

## 2026-10-19

* **The `?ipAddress=` query form works.**
  `GET /api/v1?apiKey=YOUR_API_KEY&ipAddress={ip}`, the form every WhoisXML API
  uses, now reaches the API through the public host, and these docs use it
  again. The path form, `GET /api/v1/ip/{ip}`, still returns the same response.

## 2026-10-15

* **Confidence and freshness fields start at Pro.** On Intro and Starter,
  `confidence` and the freshness fields (`first_seen`, `last_seen`,
  `observation_count`, `hits_days_pct`, `providers_num`, `confidence_decay`,
  `freshness_class`) now return `null`, and Starter returns `provider` as `null`
  on a residential proxy label, as the [Tiers](https://vpn-docs.wxapros.com/tiers.md) table says. `risk_score`
  and the `is_*` flags stay on every plan, and lookups made without a key now
  return `provider` and `confidence` as `null`.
* **`vpn_concentrator` retired.** We no longer assign `vpn_concentrator`, which
  sets `is_vpn`: a detection that would have carried it now returns the advisory
  `suspected_vpn`, which sets no `is_*` flag. Addresses labelled before this
  change can still return `vpn_concentrator`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.