Response fields
Response fields
Every field the lookup returns, grouped the way the response groups them.
A lookup returns one JSON object with ten groups. Fields live inside their group, so you read data.geo.country_code, not data.country. Dotted names like crawler.verified are nested objects inside their group.
| Group | What's in it |
|---|---|
ip | The address the response describes |
asn | The network that routes it, the ISP and the connection type |
geo | Country, region, city, time zone and coordinates |
whois | The registry record for the block |
network | Reverse DNS, the abuse contact, open ports and cloud region |
detection | VPN, proxy, Tor, relay, hosting, mobile and satellite flags |
threat | Threat flags, DNS blocklists and verified crawlers |
dns | Reverse DNS, also mirrored in network |
scoring | The 0 to 100 fraud score and the signals behind it |
meta | When the address was classified and the request id |
Every plan gets every group and every field, including requests without a key.
Empty values
The API never returns null. A text field with no value comes back as the string "none", and a number with no value comes back as 0. Check for "none" when you parse.
const city = data.geo.city === "none" ? null : data.geo.city;