Context API
Real-time, explainable IP enrichment. One GET returns network type, anonymization, ASN reputation, geo, and, where we have seen the IP, device and honeypot threat context.
Endpoints
| Method & path | Auth | Purpose |
|---|---|---|
GET /v1/context/<ip> | Bearer / X-API-Key | full IP context (primary endpoint) |
GET /api/classify?ip=<ip> | optional | lightweight public classifier; omit ip for the caller's own IP |
POST /api/prism/check | publishable key | browser assessment (called by /f.js) |
GET /api/prism/assessment/<id> | secret key | retrieve a stored assessment |
shell
curl "https://api.farox.io/v1/context/8.8.8.8" \ -H "Authorization: Bearer <api key>"
Response schema
| Field | Meaning |
|---|---|
ip | the address queried |
as.number / as.organization | ASN and owning org |
as.reputation | how anonymization-dense the whole ASN is (label, density, dominant kind, named services) |
location.country / country_code | geo |
anonymous | true if VPN / proxy / Tor / suspect |
type | network type (RESIDENTIAL / DATACENTER / VPN / ...) |
service | named provider when known |
vpn / proxy / tor / datacenter | specific flags |
risk | 0-100 risk score |
device | device class from our Prism telemetry (full fingerprint on paid) |
threat | huntback honeypot intel: seen-on-decoys, classification, attack tags (CVEs on paid) |
Rate limits
Free keys are capped per day; paid tiers raise or remove the cap. Unauthenticated /api/classify is IP-rate-limited. See pricing.