Docs

Response schema

Every successful /v1/check call returns this structure. Fields are stable; new fields may be added over time but existing ones won't change meaning without a version bump.

{
  "ip": "8.8.8.8",
  "version": 4,
  "geo": {
    "country": "United States",
    "country_code": "US",
    "region": "California",
    "city": "Mountain View",
    "latitude": 37.4,
    "longitude": -122.1,
    "timezone": "America/Los_Angeles"
  },
  "network": {
    "asn": 15169,
    "as_org": "Google LLC"
  },
  "signals": {
    "is_datacenter": true,
    "datacenter_provider": "gcp",
    "is_tor": false,
    "is_vpn": false,
    "is_proxy": false,
    "is_bot": false
  },
  "risk": {
    "score": 35,
    "level": "medium",
    "reasons": [
      "is_datacenter"
    ]
  },
  "attribution": "https://geoq.io/attributions"
}

Fields

Field	Type	Description
`ip`	string	The IP address that was checked.
`version`	number	IP version: 4 or 6.
`geo.country`	string	Country name.
`geo.country_code`	string	ISO 3166-1 alpha-2 country code.
`geo.region`	string	Region / state (best-effort).
`geo.city`	string	City (best-effort).
`geo.latitude`	number	Approximate latitude of the network.
`geo.longitude`	number	Approximate longitude of the network.
`geo.timezone`	string	IANA timezone, e.g. America/Los_Angeles.
`network.asn`	number	Autonomous System Number.
`network.as_org`	string	AS organisation name.
`signals.is_vpn`	boolean	IP is in a known commercial VPN range.
`signals.is_proxy`	boolean	Open/anonymising proxy (residential detection beta).
`signals.is_datacenter`	boolean	IP is in a known hosting/cloud range.
`signals.datacenter_provider`	string\|null	Provider code (aws, gcp, azure, …) or null.
`signals.is_tor`	boolean	IP is a current Tor exit node.
`signals.is_bot`	boolean	Automation heuristic (beta).
`risk.score`	number	0–100 capped sum of triggered signal weights.
`risk.level`	string	low (<30), medium (30–59), high (≥60).
`risk.reasons`	string[]	The signal keys that contributed to the score.
`attribution`	string	URL to the required attribution page.

Notes on honesty

geo is approximate and locates the network, not the device.
signals.is_proxy and signals.is_bot are beta.
All signals are probabilistic. risk.reasons shows exactly what fired so you can audit any score.
attribution must be honoured on the Free tier — see attributions.