Why is my API request failing with a permissions error?
Each API token has specific permissions enabled by an organization admin. If a request fails with a permissions error, an admin can review and update the token's permissions under Settings → API. For historical Context API requests specifically, a permissions error can also mean the account doesn't have the Enterprise historical-access add-on subscription enabled, separate from the token's own permission settings.
Similar questions
How do I rotate, edit, or delete an API token?
Organization admins manage tokens in Settings → API. Open a token's More options menu to edit, rotate, or delete it. Creating, editing, and deleting tokens needs a Team plan or above; on other plans, admins can view, copy, and rotate the organization's one token.
Why can't I create an API token?
Token creation requires an eligible plan and organization admin permissions. If you're an admin but don't see the option to create a token, your current plan may not include self-service token management — check your plan under Settings → Billing or contact Sales about upgrading. Logging out and back in won't resolve a plan-related limitation.
Why does my API key return a 401 error?
A 401 from the Context API usually means the API key is invalid, expired, or missing from the request. Common causes: the key was rotated or revoked, the key is being sent in the wrong header format, or the subscription has lapsed. Check your API key under Settings → API and confirm your subscription is active before retrying.
How do I get my Context API token?
If you purchased the API from our website or linked your enterprise plan to an online account, view your token at https://app.spur.us/settings/api. Otherwise, contact your Spur rep for access information.
What IP addresses does the Context API use?
The Context API is served from api.spur.us over HTTPS on port 443, so the simplest firewall rule is to allow that hostname. If your firewall can only allow IP addresses, allow Spur's fixed addresses: 136.82.115.246 (IPv4) and 2600:1901:0:448b:: (IPv6). api.spur.us used to be served from Google's shared IP addresses, which change. If you allowed those instead of the hostname and Context API requests now time out or can't connect, add the two addresses above. See Network and firewall in the Context API docs: https://docs.spur.us/context-api#network-and-firewall
Related guides & explainers
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.
Understanding Monocle Application Health Status
Each Monocle application shows a health status dot indicating whether it's actively sending traffic. Learn what each color means, how to set each application's health threshold, how health alert emails work, and what to check if an application goes quiet.
Troubleshooting Sign-in, SAML and SSO
Can't sign in to Spur? Work through the common causes: how sign-in works, corporate email checks, password resets, finding your organization, and SAML single sign-on.