Why might a feed result differ from an API lookup for the same IP?
Data feeds are point-in-time snapshots, while the API can return more current, near-real-time data. A timestamp gap between feed generation and your API query is the most common cause of a difference.
Similar questions
What are the exact boundary semantics of the Anonymous +Residential Realtime feed's 5-minute window?
The window is inclusive of the start time and exclusive of the end time. For example, the file at /v2/anonymous-residential/realtime/<YYYYMMDD>/1300.json.gz covers detections from 12:55:00 up to and including 12:59:59 UTC — 13:00:00 is not included and appears in the next file (1305.json.gz) instead. When consuming consecutive 5-minute files, each detection belongs to exactly one file, so there's no gap or double-processing at the boundary between files.
What is the difference between the data feeds and the Context API?
Data feeds are slices of IP Context data designed for bulk ingestion — the most interesting subsets of Spur's data. The Context API is a hosted, queryable version of all of Spur's IP data.
When should I use the Exports API?
The Exports API is designed for environments where pre-processing isn't possible — for example, direct integration into a SIEM, IPS, or firewall. If you need full feed data, download the entire feed and perform your own transformation locally.
Why does the Historical Context API return a 404 for an IP?
A 404 means no historical record was stored for that IP on the requested date — it does not mean the IP was reviewed and found clean. This can happen if the IP simply wasn't tracked on that date, or if the date falls outside the historical retention window (approximately the past 2 years). The non-historical Context API has broader coverage for IPs without a historical record.
How far back does the Historical Context API go?
The Historical Context API covers approximately the past 2 years of data, available as an add-on subscription on Enterprise plans.
Related guides & explainers
Why the Organization Field Isn't Available the Same Way Across Spur's Data Feeds
The Context API's per-IP organization field isn't guaranteed in every data feed. Each feed has a different schema and covers a different slice of IP space, so field availability varies by feed.
What "Client Proxies" Means in Spur Data
"Client Proxies" in Spur data describes proxy-network activity Spur observed coming from an IP — it does not mean the IP is owned or operated by the listed provider.
Context API Chrome Extension
Install Spur's Context API Chrome Extension to look up IP enrichment data directly from any web page — highlight an IP and get results inline, without leaving your browser. This is a developer-mode tool, not a Chrome Web Store listing.
Quick Search: Finding an IP, ASN, or Service Tag
Use quick search to jump straight to any IP, ASN or service tag, a Monocle app, or a main area of the app, from anywhere, without navigating through menus.