beta

API

Every page is built from these endpoints. Send an API key as Authorization: Bearer vpndb_…; create one under Account.

This page

GET /api/v1/meta

curl -s -H 'Authorization: Bearer vpndb_EXAMPLE_NOT_A_REAL_KEY' \
  '/api/v1/meta'

All endpoints

GET /api/v1/ip/{ip}Who operates an address
GET /api/v1/ip/{ip}/historyEvery week of an address
GET /api/v1/prefix/{cidr}Any range, and who is inside it
GET /api/v1/prefix/{cidr}/addressesEvery address of a prefix, in a window
GET /api/v1/prefix/{cidr}/timelineHow a prefix was probed, day by day
GET /api/v1/asn/{asn}A network and its providers
GET /api/v1/asn/{asn}/networksEvery prefix of a network
GET /api/v1/org/{id}A company and all its networks
GET /api/v1/org/{id}/networksEvery prefix of a company
GET /api/v1/country/{cc}The infrastructure located in a country
GET /api/v1/countriesEvery country at a glance
GET /api/v1/service/{tag}A provider's profile
GET /api/v1/service/{tag}/networksEvery network a provider exits from
GET /api/v1/servicesEvery provider at a glance
POST /api/v1/bulkMany addresses at once
GET /api/v1/searchResolve free text
GET /api/v1/suggestSuggestions as you type
GET /api/v1/metaThe dataset
GET /api/v1/openapi.yamlThis specification
GET /api/v1/sourcesWhere the data comes from
API documentationOpenAPI specification
Sign in

Integration and operations

Updates and deployment

Refresh intervals, live dependencies, and offline operation.

Exactly one live dependency

A lookup queries Elasticsearch for our own measurements and reads all other data from disk. The thirteen external lists are never queried at request time.

One timer, thirteen intervals

A single hourly invocation refreshes whatever is due. Each source carries its own interval, so no second schedule is maintained.

Refresh whatever is due
node scripts/ingest-feeds.ts
SourceIntervalWhy
Tor exit list1 hExit nodes turn over hourly
Spamhaus DROP6 hUpdated several times a day
Everything else24 hDaily to weekly at the publisher

When the backend is unreachable

Locally held data continues to answer. A Tor exit, a Private Relay egress or an address on a per-provider list resolves from disk, and the response carries degraded to indicate the measured component is absent. Requests requiring our own observations return 502 with the reason stated, rather than a bare 500.

When a source fails

  • A single source failure does not affect the others.
  • The previous file is retained. Stale data that reports its own age is preferable to no data.
  • Concurrent runs cannot collide. A lock left by a terminated process is cleared rather than blocking subsequent runs.