Why does the Historical Context API return a 404 for an IP?
A 404 means no historical record was stored for that IP on the requested date — it does not mean the IP was reviewed and found clean. This can happen if the IP simply wasn't tracked on that date, or if the date falls outside the historical retention window (approximately the past 2 years). The non-historical Context API has broader coverage for IPs without a historical record.
Similar questions
How far back does the Historical Context API go?
The Historical Context API covers approximately the past 2 years of data, available as an add-on subscription on Enterprise plans.
Why might a feed result differ from an API lookup for the same IP?
Data feeds are point-in-time snapshots, while the API can return more current, near-real-time data. A timestamp gap between feed generation and your API query is the most common cause of a difference.
Why does my API key return a 401 error?
A 401 from the Context API usually means the API key is invalid, expired, or missing from the request. Common causes: the key was rotated or revoked, the key is being sent in the wrong header format, or the subscription has lapsed. Check your API key under Settings → API and confirm your subscription is active before retrying.
Why is my API request failing with a permissions error?
Each API token has specific permissions enabled by an organization admin. If a request fails with a permissions error, an admin can review and update the token's permissions under Settings → API. For historical Context API requests specifically, a permissions error can also mean the account doesn't have the Enterprise historical-access add-on subscription enabled, separate from the token's own permission settings.
Does the Context API offer historical search?
Enterprise API subscriptions can add historical lookups to their API subscription. Contact your Spur sales rep or sales@spur.us to add this.
Related guides & explainers
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
Anonymizing vs. Non-Anonymizing Tunnels: What the "anonymous" Flag Means
Not every tunnel Spur detects is built to anonymize. The tunnels object's anonymous flag distinguishes corporate/ZTNA infrastructure from services designed to obscure a user's origin.