Spur Platform & Data
63 articles
What Spur provides, product capabilities, coverage, and how to consume enrichment via API, feeds, and exports.
Why doesn't Spur's IP location match other geolocation sources?FAQMany geolocation providers fall back to registration data, which is the address on an IP's WHOIS or regional registry record. That address shows where the network was registered, not where the IP is actually used. Spur geolocates IPs from active network measurement and from location data that network operators publish for their own ranges. So when the two disagree, Spur reports where the IP measures, not where it's registered. Anycast IPs, which are served from many locations at once, are labeled as anycast rather than assigned a single location.How do I rotate, edit, or delete an API token?FAQOrganization admins manage tokens in Settings → API. Open a token's More options menu to edit, rotate, or delete it. Creating, editing, and deleting tokens needs a Team plan or above; on other plans, admins can view, copy, and rotate the organization's one token.What "Client Proxies" Means in Spur DataExplainer"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.Why the Organization Field Isn't Available the Same Way Across Spur's Data FeedsExplainerThe Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.What are the exact boundary semantics of the Anonymous +Residential Realtime feed's 5-minute window?FAQThe window is inclusive of the start time and exclusive of the end time. For example, the file at /v2/anonymous-residential/realtime/<YYYYMMDD>/1300.json.gz covers detections from 12:55:00 up to and including 12:59:59 UTC — 13:00:00 is not included and appears in the next file (1305.json.gz) instead. When consuming consecutive 5-minute files, each detection belongs to exactly one file, so there's no gap or double-processing at the boundary between files.Can we decrypt Monocle assessments ourselves instead of calling an API?FAQYes — this is already supported at no extra cost. Every Monocle application has both a Secret Key (for the hosted Decryption API) and a Private Key (for manual backend decryption) available in the Monocle Dashboard. Backend decryption lets your own server decrypt the Monocle Assessment locally using the Private Key, without making a call to Spur's Decryption API.What does the risks field represent?FAQThe Context API's risks field is an array of specific risk-factor tags observed for an IP, rather than a single composite score. Current values include AD_FRAUD, CALLBACK_PROXY, GEO_MISMATCH, LOGIN_BRUTEFORCE, TUNNEL, and WEB_SCRAPING — an IP can carry more than one, or none.Can an IP address be repeated in a feed?FAQNo. An IP address will only appear once per feed in a single line.What is the difference between the data feeds and the Context API?FAQData feeds are slices of IP Context data designed for bulk ingestion — the most interesting subsets of Spur's data. The Context API is a hosted, queryable version of all of Spur's IP data.Do I need a backend to use Monocle?FAQNo. You can use Monocle to gain visibility into traffic intelligence via the Monocle UI without acting on it. With a supported integration like Cloudflare, traffic can be enforced directly from the UI based on policy configuration. A backend is only required if you want to decrypt assessments or apply custom enforcement logic.Do you have a bulk lookup endpoint?FAQNo. Each IP must be submitted individually to the Context API.Does Monocle block traffic?FAQNo, not by default. Monocle evaluates traffic and returns a decision (such as Block or Allow); your system is responsible for enforcing that decision. The exception is supported edge integrations, such as Cloudflare, where Monocle can enforce decisions directly.How do I integrate Monocle?FAQThe most common way is by adding a JavaScript snippet to your application. You can also integrate Monocle using backend or edge-based approaches depending on your setup. See https://docs.spur.us/monocle/integrations for details.How do I report a false positive or other error in feed data?FAQSearch for the entity in the Spur Dashboard (https://app.spur.us) and use the Report button to submit a report.How long does it take to see data?FAQTypically within minutes of integrating Monocle. In some cases, it may take up to an hour for data to appear in the dashboard.What is the difference between using Monocle to monitor vs. enforce traffic decisions?FAQMonitor is passive: Monocle provides visibility into how users connect to your application without impacting users or taking any blocking action. Enforce applies actions such as blocking or allowing traffic based on Monocle's assessments. Most users start with a monitoring phase before configuring and enabling enforcement.What is the difference between Raw Assessment and Policy API?FAQWith Raw Assessment, you decrypt and evaluate traffic yourself for full control. With the Policy API, Monocle evaluates traffic and returns a decision directly, which is simpler to implement.What is a Monocle assessment?FAQA Monocle assessment is an encrypted payload generated for each session. It contains information about how a user is connecting, such as VPN usage, proxy detection, and anonymized status. You can decrypt and evaluate this data in your backend, or analyze it directly in the Monocle UI.What is Monocle?FAQMonocle is a traffic intelligence tool that identifies anonymized traffic such as VPNs, proxies, and datacenter connections, and provides insights into how users are connecting to your application.When should I use the Exports API?FAQThe Exports API is designed for environments where pre-processing isn't possible — for example, direct integration into a SIEM, IPS, or firewall. If you need full feed data, download the entire feed and perform your own transformation locally.Where does enforcement actually happen?FAQIn most setups, enforcement happens in your own infrastructure, such as backend logic, API gateways, or middleware. For Cloudflare integrations, enforcement can happen at the edge and is directly configurable via the Monocle UI.Which policy strategy should I use?FAQAllow All applies no blocking rules. Normal is recommended for most use cases. Aggressive blocks all anonymized traffic and carries a higher risk of false positives. Custom (Pro) gives access to all standard options plus more granular assessment attribute-level configuration.Why am I not seeing any data?FAQCheck that your Monocle script is correctly installed, your publishable key is valid, and traffic is reaching your application.Why did my Monocle assessment volume suddenly drop?FAQA sudden drop in assessment volume is usually caused by a change on your side — a recent deployment, a Content Security Policy (CSP) update, or a Cloudflare configuration change — rather than a Spur outage. To rule out a Spur-side issue, check https://status.spur.us. Then review your worker logs and recent configuration changes. If volume still looks incorrect after that, contact support@spur.us with the time the drop started and any recent changes you made.
Showing 1–24 of 63
1 / 3