PrivacyExtendedResponse

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/ipinfo/main/json-schema/ipinfo-privacy-extended-response-schema.json",
  "title": "PrivacyExtendedResponse",
  "description": "PrivacyExtendedResponse schema from IPinfo API",
  "type": "object",
  "properties": {
    "vpn": {
      "type": "boolean",
      "description": "Indicates Virtual Private Network (VPN) service exit node IP address",
      "example": true
    },
    "proxy": {
      "type": "boolean",
      "description": "Indicates an open web proxy IP address",
      "example": false
    },
    "tor": {
      "type": "boolean",
      "description": "Indicates a Tor (The Onion Router) exit node IP address",
      "example": false
    },
    "relay": {
      "type": "boolean",
      "description": "Indicates a location-preserving anonymous relay service",
      "example": false
    },
    "hosting": {
      "type": "boolean",
      "description": "Indicates a hosting/cloud service/data center IP address",
      "example": true
    },
    "service": {
      "type": "string",
      "description": "Name of the privacy service provider - includes VPN, Proxy, and Relay service provider names",
      "example": "NordVPN"
    },
    "confidence": {
      "type": "integer",
      "minimum": 1,
      "maximum": 3,
      "description": "The level of confidence attributed to the best source associated with this range. Level 3 - Direct observation of commercial use (vpn_config). Level 2 - Direct observation of VPN software running on the range (census) + registrar information associated with VPNs or specific providers OR highly convincing device activity. Level 1 - Direct observation of VPN software running on the range (census) without known association to specific providers or VPNs in general OR suspicious device data not associated with hosting ranges",
      "example": 3
    },
    "coverage": {
      "type": "number",
      "minimum": 0,
      "maximum": 1,
      "description": "For inferred ranges, represents the proportion of the range (in IP count) that we saw direct evidence of VPN activity on. For IPs/ranges we've fully directly observed VPN evidence on, this value is 1.0",
      "example": 1.0
    },
    "census": {
      "type": "boolean",
      "description": "Ranges where we've observed VPN software/ports on; we run scans on ports and protocols commonly associated with VPN software. Ranges with the census flag are those where these scans obtained positive results",
      "example": false
    },
    "census_ports": {
      "type": "array",
      "items": {
        "type": "integer"
      },
      "description": "The ports we've gotten positive results for when running our VPN detection census",
      "example": []
    },
    "device_activity": {
      "type": "boolean",
      "description": "Ranges on which we've observed device activity compatible with VPN usage (outside of known infrastructure area; simultaneous use around a large area; pingable and/or associated with hosting providers)",
      "example": false
    },
    "inferred": {
      "type": "boolean",
      "description": "Whether the range associated with the record is the result of direct observation or inference based on neighboring IPs",
      "example": false
    },
    "vpn_config": {
      "type": "boolean",
      "description": "Ranges where we confirmed VPN activity by directly running VPN software from almost 200 different providers and collecting exit IPs",
      "example": false
    },
    "whois": {
      "type": "boolean",
      "description": "Ranges where we've observed VPN software/ports on AND have a WHOIS association with either VPNs in general or specific VPN providers",
      "example": false
    },
    "first_seen": {
      "type": "string",
      "format": "date",
      "description": "Date when the activity on an anonymous IP address was first observed. Date in YYYY-MM-DD format, ISO-8601. Within the 3-month lookback period",
      "example": "2025-09-19"
    },
    "last_seen": {
      "type": "string",
      "format": "date",
      "description": "Date when the activity on an anonymous IP address was last/recently observed. Date in YYYY-MM-DD format, ISO-8601",
      "example": "2025-11-06"
    }
  },
  "required": [
    "vpn",
    "proxy",
    "tor",
    "relay",
    "hosting",
    "service"
  ]
}